Skip to content

Commit 9a9e8ad

Browse files
chanel-ychanel-y
authored
Merge pull request #347 from microsoft/users/chanely/deprecated-tls
Use of deprecated tls version
2 parents ac52680 + d824fd9 commit 9a9e8ad

7 files changed

Lines changed: 175 additions & 0 deletions

File tree

‎powershell/ql/src/queries/security/cwe-757/DeprecatedTls.qhelp‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
2+
<qhelp>
3+
<overview>
4+
<p>
5+
TLS (Transport Layer Security) and its predecessor SSL (Secure Sockets Layer) are protocols
6+
used to secure network communications. Older versions of these protocols have known
7+
vulnerabilities that can be exploited by attackers to compromise the confidentiality and
8+
integrity of data in transit.
9+
</p>
10+
<p>
11+
The following versions are considered deprecated:
12+
</p>
13+
<ul>
14+
<li>SSL 3.0 is vulnerable to the POODLE attack and other weaknesses.</li>
15+
<li>TLS 1.0 has known vulnerabilities including the BEAST attack and weak cipher suites.</li>
16+
<li>TLS 1.1 lacks support for modern cryptographic algorithms and is deprecated by RFC 8996.</li>
17+
</ul>
18+
</overview>
19+
<recommendation>
20+
<p>
21+
Use TLS 1.2 or TLS 1.3 for all secure communications. TLS 1.3 is preferred as it removes
22+
support for legacy cryptographic features and provides improved performance. When configuring
23+
<code>SecurityProtocolType</code>, use <code>Tls12</code> or <code>Tls13</code>.
24+
</p>
25+
</recommendation>
26+
<example>
27+
<p>
28+
In the following example, the script enables the deprecated SSL 3.0 and TLS 1.0 protocols:
29+
</p>
30+
<sample src="examples/DeprecatedTls/DeprecatedTlsBad.ps1" />
31+
<p>
32+
The following example shows the corrected code using TLS 1.2:
33+
</p>
34+
<sample src="examples/DeprecatedTls/DeprecatedTlsGood.ps1" />
35+
</example>
36+
<references>
37+
<li>IETF, RFC 8996: <a href="https://datatracker.ietf.org/doc/html/rfc8996">Deprecating TLS 1.0 and TLS 1.1</a>.</li>
38+
<li>NIST, SP 800-52 Rev. 2: <a href="https://csrc.nist.gov/publications/detail/sp/800-52/rev-2/final">Guidelines for the Selection, Configuration, and Use of TLS Implementations</a>.</li>
39+
<li>OWASP: <a href="https://cheatsheetseries.owasp.org/cheatsheets/Transport_Layer_Security_Cheat_Sheet.html">Transport Layer Security Cheat Sheet</a>.</li>
40+
<li>CWE-757: <a href="https://cwe.mitre.org/data/definitions/757.html">Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')</a>.</li>
41+
</references>
42+
</qhelp>

‎powershell/ql/src/queries/security/cwe-757/DeprecatedTls.ql‎

Lines changed: 90 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,90 @@
1+
/**
2+
* @name Use of deprecated TLS/SSL version
3+
* @description Using deprecated TLS/SSL versions (SSL3, TLS 1.0, TLS 1.1) weakens transport security.
4+
* @kind problem
5+
* @problem.severity error
6+
* @security-severity 7.5
7+
* @precision high
8+
* @id powershell/deprecated-tls
9+
* @tags security
10+
* external/cwe/cwe-327
11+
* external/cwe/cwe-757
12+
*/
13+
14+
import powershell
15+
import semmle.code.powershell.ApiGraphs
16+
import semmle.code.powershell.dataflow.DataFlow
17+
18+
/**
19+
* Gets the human-readable name for a deprecated protocol.
20+
*/
21+
bindingset[protocolName]
22+
string getProtocolDisplayName(string protocolName) {
23+
protocolName = "ssl3" and result = "SSL 3.0"
24+
or
25+
protocolName = "tls" and result = "TLS 1.0"
26+
or
27+
protocolName = "tls11" and result = "TLS 1.1"
28+
}
29+
30+
abstract class SecurityProtocol extends Expr {
31+
abstract string getProtocolName();
32+
}
33+
34+
/**
35+
* A reference to a deprecated SecurityProtocolType enum value, e.g.
36+
* [Net.SecurityProtocolType]::Ssl3
37+
*/
38+
class DeprecatedSecurityProtocolType extends SecurityProtocol {
39+
string protocolName;
40+
41+
DeprecatedSecurityProtocolType() {
42+
exists(API::Node node |
43+
(
44+
node =
45+
API::getTopLevelMember("system")
46+
.getMember("net")
47+
.getMember("securityprotocoltype")
48+
.getMember(protocolName)
49+
or
50+
node =
51+
API::getTopLevelMember("net")
52+
.getMember("securityprotocoltype")
53+
.getMember(protocolName)
54+
) and
55+
this = node.asSource().asExpr().getExpr()
56+
)
57+
}
58+
59+
override string getProtocolName() { result = protocolName }
60+
}
61+
62+
/**
63+
* A reference to a deprecated SslProtocols enum value, e.g.
64+
* [System.Security.Authentication.SslProtocols]::Tls
65+
*/
66+
class DeprecatedSslProtocols extends SecurityProtocol {
67+
string protocolName;
68+
69+
DeprecatedSslProtocols() {
70+
exists(API::Node node |
71+
node =
72+
API::getTopLevelMember("system")
73+
.getMember("security")
74+
.getMember("authentication")
75+
.getMember("sslprotocols")
76+
.getMember(protocolName) and
77+
this = node.asSource().asExpr().getExpr()
78+
)
79+
}
80+
81+
override string getProtocolName() { result = protocolName }
82+
}
83+
84+
from SecurityProtocol sp, string protocolName
85+
where
86+
protocolName = sp.getProtocolName() and
87+
protocolName = ["ssl3", "tls", "tls11"]
88+
select sp,
89+
"Use of deprecated protocol " + getProtocolDisplayName(protocolName) +
90+
". Use TLS 1.2 or TLS 1.3 instead."

‎powershell/ql/src/queries/security/cwe-757/examples/DeprecatedTls/DeprecatedTlsBad.ps1‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# BAD: Using deprecated SSL 3.0
2+
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Ssl3
3+
4+
# BAD: Using deprecated TLS 1.0
5+
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls
6+
7+
# BAD: Using deprecated TLS 1.1
8+
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls11

‎powershell/ql/src/queries/security/cwe-757/examples/DeprecatedTls/DeprecatedTlsGood.ps1‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# GOOD: Using TLS 1.2
2+
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
3+
4+
# GOOD: Using TLS 1.3
5+
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls13

‎powershell/ql/test/query-tests/security/cwe-757/DeprecatedTls/DeprecatedTls.expected‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
| test.ps1:6:47:6:78 | ssl3 | Use of deprecated protocol SSL 3.0. Use TLS 1.2 or TLS 1.3 instead. |
2+
| test.ps1:9:47:9:77 | tls | Use of deprecated protocol TLS 1.0. Use TLS 1.2 or TLS 1.3 instead. |
3+
| test.ps1:12:47:12:79 | tls11 | Use of deprecated protocol TLS 1.1. Use TLS 1.2 or TLS 1.3 instead. |
4+
| test.ps1:15:54:15:91 | tls | Use of deprecated protocol TLS 1.0. Use TLS 1.2 or TLS 1.3 instead. |

‎powershell/ql/test/query-tests/security/cwe-757/DeprecatedTls/DeprecatedTls.qlref‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
queries/security/cwe-757/DeprecatedTls.ql

‎powershell/ql/test/query-tests/security/cwe-757/DeprecatedTls/test.ps1‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
# ===================================================================
2+
# ========== TRUE POSITIVES (should trigger alert) ==================
3+
# ===================================================================
4+
5+
# --- Case 1: SSL 3.0 ---
6+
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Ssl3 # BAD
7+
8+
# --- Case 2: TLS 1.0 ---
9+
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls # BAD
10+
11+
# --- Case 3: TLS 1.1 ---
12+
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls11 # BAD
13+
14+
# --- Case 4: Full namespace TLS 1.0 ---
15+
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls # BAD
16+
17+
# ===================================================================
18+
# ========== TRUE NEGATIVES (should NOT trigger alert) ==============
19+
# ===================================================================
20+
21+
# --- Safe: TLS 1.2 ---
22+
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 # GOOD
23+
24+
# --- Safe: TLS 1.3 ---
25+
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls13 # GOOD

0 commit comments

Comments
 (0)