Trustmanager Accepts All
This X509TrustManager has an empty checkServerTrusted/checkClientTrusted method, so it accepts every certificate and disables TLS authentication (CWE-295).
Standards mapping
- OWASP ASVS
- V9.2.1 (L2)
Vulnerable vs. safe
public void checkServerTrusted(X509Certificate[] chain, String authType) { }public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {Why it matters & how to fix it
This X509TrustManager has an empty checkServerTrusted/checkClientTrusted method, so it accepts every certificate and disables TLS authentication (CWE-295). This makes the connection trivially man-in-the-middleable. Remove the custom trust manager and use the platform default, or validate the chain against a pinned CA/certificate and throw CertificateException on failure.
References
Rule ID integsec-java-trustmanager-accepts-all - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- JavaScript / TypeScript - Other Security ChecksChild Process Shell True
- JavaScript / TypeScript - Other Security ChecksOpen Redirect Tainted Input
- Python - Other Security ChecksDjango Mark Safe
- Python - Other Security ChecksFlask Debug Enabled
- Python - Other Security ChecksFlask Render Template String
- Python - Other Security ChecksInsecure Tempfile Mktemp