> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/4-sast/2-java/missing-ssl-host-check-in-smtp.md).

# Missing SSL host check in SMTP

## Overview

* **Rule ID**: `java_lang_missing_smtp_ssl_host_check`
* **Applicable Languages**: Java
* **Weakness ID**: CWE-297

## Description

The absence of an SSL host check in SMTP can compromise the security of email communications. This vulnerability occurs when SSL certificates are not correctly validated to verify their origin from the expected host. This oversight may enable attackers to impersonate legitimate entities by using valid SSL certificates obtained from other hosts.

## Remediation Guidelines

* **Ensure** your email client is configured to verify the server's identity. This step is essential to prevent attackers from impersonating a trusted server, thereby avoiding redirection or spoofing attacks.

  ```java
  Email email = new Email();
  email.setSSLOnConnect(true);
  email.setSSLCheckServerIdentity(true);
  ```

## References

* [**CWE-297: Improper Validation of Certificate with Host Mismatch**](https://cwe.mitre.org/data/definitions/297.html)
* [**OWASP Top 10: A07:2021 - Identification and Authentication Failures**](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)

## Configuration

To omit this rule during a scan, and to provide you with continuous 24/7 code-level scanning, you can employ our [**SAST TOOL**](https://scopy.sec1.io/login)