Usage of insecure SMTP connection

• Rule ID: ruby_rails_insecure_smtp
• Languages: ruby
• Source: insecure_smtp.yml

Description

Using an insecure SMTP connection exposes your data to interception by unauthorized parties. Alwats check that your application's SMTP settings enforce secure connections.

Remediations

• Do enable SSL encryption in your SMTP settings to secure the connection. For Ruby on Rails' ActionMailer, configure as follows:

  config.action_mailer.smtp_settings = {
    ...
    ssl: true
  }

References

• Ruby on Rails configuring Action Mailer
• OWASP insecure transport

Associated CWE

• CWE-319: Cleartext Transmission of Sensitive Information

OWASP Top 10

• A02:2021 - Cryptographic Failures

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=ruby_rails_insecure_smtp

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=ruby_rails_insecure_smtp