TLS/SSL Misconfiguration

Description

TLS/SSL misconfiguration (CWE-326 — Inadequate Encryption Strength) is a broad category of vulnerabilities arising from improperly configured Transport Layer Security implementations. Despite TLS being the foundation of secure web communication, the protocol has numerous configuration knobs — supported versions, cipher suites, certificate validation, HSTS policies, and key exchange parameters — each of which can be set insecurely. A single misconfigured option can expose encrypted traffic to interception, enable protocol downgrade attacks, or allow man-in-the-middle scenarios even when the application correctly uses HTTPS.

This falls under A02:2021 — Cryptographic Failures because the cryptographic protection is technically present but rendered ineffective by configuration. Common misconfigurations include: supporting deprecated protocol versions (SSLv2, SSLv3, TLS 1.0, TLS 1.1), enabling weak or null cipher suites, using DH parameters shorter than 2048 bits (Logjam), missing HSTS headers, allowing HTTP fallback, using self-signed or expired certificates, and exposing Heartbleed-vulnerable OpenSSL versions.

TLS misconfiguration is significant across all service types: web APIs accept connections from misconfigured clients, network infrastructure (load balancers, VPNs, mail servers) frequently exposes legacy protocol support, and mobile apps that disable certificate validation or trust user-installed certificates are independently vulnerable.

How It Works

Protocol downgrade attacks exploit support for older TLS versions. The POODLE attack (CVE-2014-3566) used SSL 3.0's weak CBC padding. BEAST (CVE-2011-3389) targeted TLS 1.0's CBC implementation. If a server still accepts connections using these versions, a network attacker performing an active man-in-the-middle attack can trigger a protocol downgrade:

Client: "I support TLS 1.3, 1.2, 1.1, 1.0, SSLv3"
Attacker (MITM): Drops TLS 1.3/1.2/1.1 ClientHello packets
Server: Negotiates SSLv3 (or TLS 1.0)
Attacker: Decrypts traffic using known attacks

Weak cipher suites include:

• NULL encryption — no encryption at all, only authentication.
• EXPORT ciphers — intentionally weakened for 1990s US export regulations (40-56 bit keys). FREAK and LOGJAM attacks exploit these.
• RC4 — statistical biases allow decryption of known plaintext positions.
• DES/3DES — Sweet32 birthday attack after ~785 GB of traffic.
• ANON key exchange — no server authentication, trivially MITM'd.

Logjam (CVE-2015-4000) exploits the use of 512-bit or 1024-bit Diffie-Hellman parameters. With precomputed tables, connections using these parameters can be downgraded to 512-bit "EXPORT_DHE" and decrypted.

Missing HSTS allows HTTP downgrade attacks. If Strict-Transport-Security is not set (or set with includeSubDomains missing), an attacker who can perform a first-request MITM can intercept the initial HTTP connection before the browser knows to use HTTPS. SSLStrip automates this attack.

Scanning TLS configuration is straightforward with testssl.sh:

testssl.sh --full https://app.example.com
# Reports: protocol versions, cipher suites, certificate issues,
# HSTS/HPKP, Heartbleed, POODLE, BEAST, FREAK, LOGJAM, DROWN, etc.

Impact

• Traffic decryption — active MITM attacks combined with protocol weaknesses allow decryption of "encrypted" traffic, exposing credentials, session tokens, and sensitive API payloads.
• Session hijacking — decrypted session cookies provide authenticated access to user accounts.
• Credential theft — login forms and API authentication flows expose credentials when traffic is decrypted.
• Data integrity violation — cipher modes without authentication (CBC without MAC) allow active injection of data into streams.
• API communication interception — mobile apps and microservices communicating with misconfigured TLS are vulnerable to server impersonation.
• Compliance failure — PCI-DSS, HIPAA, FedRAMP, and SOC 2 all mandate strong TLS configurations. Failures trigger audit findings and potential fines.

Detection

1. Run testssl.sh against all HTTPS endpoints — testssl.sh --full <host>. Check for SSLv2, SSLv3, TLS 1.0, TLS 1.1, EXPORT ciphers, RC4, NULL suites, Heartbleed, POODLE, LOGJAM, FREAK, BEAST, and DROWN.
2. Run sslyze for a programmatic summary — sslyze --regular <host>:<port>. Useful for CI/CD integration.
3. Check HSTS configuration — verify the Strict-Transport-Security header is present with max-age ≥ 31536000 (1 year), includeSubDomains, and ideally preload.
4. Check for HTTP availability — confirm that http:// connections are immediately redirected to https:// with a 301, and that the redirect itself is not sensitive (login forms should not appear over HTTP even briefly).
5. Test DH parameter size — a testssl.sh result showing DH parameters < 2048 bits indicates Logjam susceptibility.
6. Verify certificate validity — check expiry date, correct hostname, chain completeness, and that the CA is trusted. Use openssl s_client -connect host:443 to inspect the full certificate chain.

Remediation

Enforce TLS 1.2 and TLS 1.3 only. Disable TLS 1.0, TLS 1.1, SSLv3, and SSLv2 at the server, load balancer, and CDN configuration level. In nginx:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/nginx/dhparam.pem;  # Generate with: openssl dhparam -out dhparam.pem 4096

Configure HSTS. Add Strict-Transport-Security: max-age=63072000; includeSubDomains; preload to all HTTPS responses. Submit to the HSTS preload list at hstspreload.org.

Use the Mozilla SSL Configuration Generator (ssl-config.mozilla.org) for server-specific configurations tailored to your nginx, Apache, or HAProxy version.

Keep TLS libraries patched. OpenSSL, BoringSSL, and NSS vulnerabilities are discovered regularly. Maintain patching cycles for the TLS stack.