rules:
- id: tls-renegotiation
  message: >-
    Checks for cases where java applications are allowing unsafe renegotiation.
    This leaves the application vulnerable to a man-in-the-middle attack where chosen plain text is injected
    as prefix to
    a TLS connection.
  severity: WARNING
  metadata:
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://www.oracle.com/java/technologies/javase/tlsreadme.html
    subcategory:
    - vuln
    technology:
    - java
    vulnerability: Insecure Transport
  languages:
  - java
  pattern: |
    java.lang.System.setProperty("sun.security.ssl.allowUnsafeRenegotiation", true);