gRPC Node.js Insecure Connection

What it is

The Node.js application establishes gRPC connections without proper TLS encryption, transmitting sensitive data over unencrypted channels. This vulnerability exposes communication between gRPC services to potential eavesdropping, man-in-the-middle attacks, and data interception.

// Vulnerable: Insecure gRPC connection
const grpc = require('@grpc/grpc-js');
const protoLoader = require('@grpc/proto-loader');

const packageDefinition = protoLoader.loadSync('service.proto');
const serviceProto = grpc.loadPackageDefinition(packageDefinition);

// Dangerous: Unencrypted connection
const client = new serviceProto.MyService('localhost:50051',
  grpc.credentials.createInsecure());

client.getData({}, (error, response) => {
  console.log(response);
});

// Secure: TLS-encrypted gRPC connection
const grpc = require('@grpc/grpc-js');
const protoLoader = require('@grpc/proto-loader');
const fs = require('fs');

const packageDefinition = protoLoader.loadSync('service.proto');
const serviceProto = grpc.loadPackageDefinition(packageDefinition);

// Load TLS credentials
const serverCert = fs.readFileSync('server-cert.pem');
const sslCredentials = grpc.credentials.createSsl(serverCert);

// Secure: TLS-encrypted connection
const client = new serviceProto.MyService('localhost:50051', sslCredentials);

client.getData({}, (error, response) => {
  if (error) {
    console.error('gRPC error:', error);
    return;
  }
  console.log(response);
});

Why it happens

Node.js gRPC applications use grpc.credentials.createInsecure() to establish unencrypted connections to gRPC servers: const client = new ServiceClient(address, grpc.credentials.createInsecure()). This explicitly disables TLS encryption for convenience during development but gets deployed to production environments. Unencrypted gRPC communication transmits all request/response data including sensitive business logic, authentication tokens, PII, and financial data in plaintext. Network attackers with packet capture capabilities on internal networks can eavesdrop on gRPC traffic, extract sensitive information, or perform man-in-the-middle attacks injecting malicious responses. createInsecure() is documented as development-only but no runtime warnings prevent production usage.

Fixes

Related Vulnerabilities