This weakness occurs when software fails to properly verify the identity of both parties in a communication channel, leaving it vulnerable to man-in-the-middle…
This weakness occurs when software fails to properly verify the identity of both parties in a communication channel, leaving it vulnerable to man-in-the-middle (MITM) attacks. An attacker positioned between a client and server can intercept, read, or modify data in transit without either party detecting the intrusion. This is a foundational network security flaw that undermines the confidentiality and integrity of any data exchanged.
The vulnerability arises when applications establish connections without mutual authentication or without validating the authenticity of the endpoint they're communicating with. Common causes include:
- Unencrypted connections:
Using HTTP instead of HTTPS, or plain TCP sockets instead of TLS, means data travels in cleartext and can be read by anyone on the network path.
- Missing certificate validation:
Even when encryption is used, the client may not verify that the server's certificate is legitimate, allowing an attacker to present a forged certificate.
- No mutual authentication:
The server may not verify the client's identity, or vice versa, enabling unauthorized parties to impersonate legitimate endpoints.
- Weak or missing cryptographic handshakes:
Protocols that don't properly authenticate the key exchange allow attackers to inject themselves into the session.
A successful MITM attack can lead to credential theft (login credentials captured in transit), session hijacking (attacker steals authentication tokens), data exfiltration (sensitive information read from requests or responses), or data tampering (attacker modifies requests or responses to alter application behavior). In financial or healthcare contexts, this can result in fraudulent transactions or exposure of protected health information. Even seemingly low-risk applications can be compromised if they handle user data or authentication.
import socket
# Vulnerable: unencrypted socket connection, no identity verification
def send_user_data(host, port, user_input):
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((host, port))
sock.sendall(user_input.encode())
response = sock.recv(1024)
sock.close()
return responseWhy it's vulnerable:
The connection is unencrypted and performs no verification of the server's identity. An attacker on the network can intercept the data, read it, or impersonate the server.
import ssl
import socket
# Fixed: TLS encryption with certificate verification
def send_user_data(host, port, user_input):
context = ssl.create_default_context()
# create_default_context() enables certificate verification by default
with socket.create_connection((host, port)) as sock:
with context.wrap_socket(sock, server_hostname=host) as ssock:
ssock.sendall(user_input.encode())
response = ssock.recv(1024)
return response<?php
// Vulnerable: HTTP request without certificate verification
$url = "http://api.example.com/user/data";
$context = stream_context_create();
$response = file_get_contents($url, false, $context);
echo $response;
?>Why it's vulnerable:
The connection uses HTTP (unencrypted) and does not verify the server's identity. An attacker can intercept or modify the data in transit.
<?php
// Fixed: HTTPS with certificate verification enabled
$url = "https://api.example.com/user/data";
$context = stream_context_create([
'ssl' => [
'verify_peer' => true,
'verify_peer_name' => true,
'allow_self_signed' => false,
]
]);
$response = file_get_contents($url, false, $context);
echo $response;
?>Monitor for unexpected network traffic patterns, such as connections to unfamiliar IP addresses or domains, or unusual SSL/TLS certificate warnings in logs. If users report being redirected to unexpected sites or seeing security warnings when accessing your application, or if authentication tokens are being reused across sessions unexpectedly, investigate whether a MITM attack is occurring. Review firewall and proxy logs for signs of certificate mismatches or failed handshakes.
