Use of cleartext transport protocol (Telnet)
Description
Telnet connection detected. Telnet transmits sensitive data like passwords in plaintext. Susceptible to sniffing and MITM attacks on insecure networks.
Examples
Insecure Code
java
org.apache.commons.net.telnet.TelnetClient telnetClient = new TelnetClient(); telnetClient.connect("example.com");Secure Code
java
com.jcraft.jsch.JSch jsch = new JSch(); jsch.getSession("username", "example.com");Remediation
Use SSH instead (e.g., with JSch or Apache MINA SSHD).
Rule Details
| Field | Value |
|---|---|
| ID | CODE-0251 |
| Category | Crypto |
| Severity | MEDIUM |
| CWE | CWE-319 |
| Confidence | MEDIUM |
| Impact | MEDIUM |
| Likelihood | MEDIUM |
| Exploitability | EASY |
| Tags | telnet, cleartext, ssh |
| OWASP | A3:2017-Sensitive Data Exposure, A02:2021-Cryptographic Failures |