VNX-924: Plain TCP socket to a remote peer: no message integrity in transit

Reports Java code that opens a plain TCP socket or listener to a non-loopback peer without TLS, so the bytes can be altered in transit.

Field	Value
Rule ID	`VNX-924`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Java
CWE	CWE-924
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`msg-integrity` `cleartext-socket` `cwe-924`
Source	`internal/sast/rules/vnx-924.rego`

Overview

Java code opens a raw TCP connection or listener with no TLS: new Socket(host, port), new ServerSocket(port), connect(new InetSocketAddress(...)) on a plain socket, SocketChannel.open(new InetSocketAddress(...)), and createSocket/createServerSocket on the non-TLS SocketFactory.getDefault()/ServerSocketFactory.getDefault().

Why This Matters

Anyone on the network path can change (or read) what is sent, and neither end can tell.

What Gets Flagged

ServerSocket server = new ServerSocket(9000);
try (Socket s = new Socket(host, port)) {
Socket t = SocketFactory.getDefault().createSocket(host, 7002);

Not flagged: SSLSocketFactory/SSLServerSocketFactory sockets, a plain socket the same file upgrades with createSocket(plain, host, port, true) (STARTTLS), loopback peers and bindings, new Socket(proxy), the Socket type in declarations, test files, comments and strings. Whether the protocol on top adds its own MAC or signature is not judged.

Remediation

Use SSLSocketFactory.getDefault() / SSLServerSocketFactory.getDefault() (or an SSLContext you configure) with hostname verification, or a protocol library that runs over TLS.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-924
// nosec vnx-924

Or record an ignore rule: vulnetix ignore add --rule vnx-924 --reason "...". See Suppressing findings.