Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

Use of a Broken or Risky Cryptographic Algorithm

The product uses a broken or risky cryptographic algorithm or protocol.

Cryptographic algorithms are the backbone of modern information security. Using algorithms that have known weaknesses, such as MD5 or DES, can make it trivial for attackers to defeat the protection.

Verbreitung

Hoch

Häufig ausgenutzt

Auswirkung

Hoch

3 Regeln mit hohem Schweregrad

Prävention

Dokumentiert

4 Fix-Beispiele

2 Prävention

So behebst du diese Schwachstelle

Präventionsstrategien für Broken Cryptographic Algorithm basierend auf 4 Shoulder-Erkennungsregeln.

🐹 Go Alle anzeigen Go Details →

Use of Weak Cryptographic Algorithm HIGH

Replace MD5/SHA1/DES/RC4 with bcrypt, SHA-256, or AES-GCM

+8 -5 go

- import "crypto/md5"
- 
- func hashPassword(password string) string {
-     hash := md5.Sum([]byte(password))
-     return hex.EncodeToString(hash[:])
+ import "golang.org/x/crypto/bcrypt"
+ 
+ func hashPassword(password string) (string, error) {
+     hash, err := bcrypt.GenerateFromPassword([]byte(password), 12)
+     if err != nil {
+         return "", err
+     }
+     return string(hash), nil
  }

🟨 JavaScript Alle anzeigen JavaScript Details →

JWT Algorithm Confusion Attack HIGH

Always specify allowed algorithms when verifying JWT tokens

+3 -1 javascript

- const decoded = jwt.verify(token, secret);
+ const decoded = jwt.verify(token, secret, {
+   algorithms: ['RS256']
+ });

Use of Weak Cryptographic Algorithm HIGH

Use SHA-256+ for hashing, AES-256-GCM for encryption, and bcrypt for passwords

+1 -1 javascript

- const hash = crypto.createHash('md5').update(data).digest('hex');
+ const hash = crypto.createHash('sha256').update(data).digest('hex');

🐍 Python Alle anzeigen Python Details →

Weak Cryptographic Algorithm MEDIUM

Replace MD5/SHA-1/DES/RC4 with SHA-256/SHA-3 for hashing and AES-GCM for encryption

+1 -1 python

  import hashlib
  
  def verify_integrity(data):
-     return hashlib.md5(data.encode()).hexdigest()
+     return hashlib.sha256(data.encode()).hexdigest()

3 Erkennung

Finden Sie Schwachstellen in Ihrem Code

Verwenden Sie Shoulder, um Ihren Code nach Use of a Broken or Risky Cryptographic Algorithm-Mustern zu scannen. 4 Regeln.

Terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=327

# Or scan entire project
npx @shoulderdev/cli trust .

Erkennungsregeln (4)

🟨 Javascript 2 rules

JWT Algorithm Confusion Attack HIGH

Detects JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that bypass authentication.

Use of Weak Cryptographic Algorithm HIGH

Detects use of weak or broken cryptographic algorithms for hashing passwords or sensitive data. **Weak algorithms detected:** - **MD5**: Cryptographically broken, vulnerable to collision attacks - **SHA1**: Deprecated, vulnerable to collision attacks - **DES/3DES**: Weak block cipher with small key size - **RC4**: Stream cipher with known vulnerabilities **Impact:** - Password hashes can be cracked using rainbow tables or brute force - Data encrypted with weak algorithms can be decrypted by at

🔷 Typescript 2 rules

JWT Algorithm Confusion Attack HIGH

Detects JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that bypass authentication.

Use of Weak Cryptographic Algorithm HIGH

🐹 Go 1 rules

Use of Weak Cryptographic Algorithm HIGH

Uses MD5, SHA1, DES, or RC4 which are cryptographically broken.

🐍 Python 1 rules

Weak Cryptographic Algorithm MEDIUM

Detects use of weak or deprecated cryptographic algorithms like MD5, SHA-1, DES, or RC4. Use modern algorithms like SHA-256, SHA-3, AES, or ChaCha20.

4 Warnzeichen

Worauf bei Code-Reviews zu achten ist

Diese Muster weisen auf potenzielle Use of a Broken or Risky Cryptographic Algorithm-Schwachstellen hin. Achten Sie bei Code-Reviews und Sicherheitsaudits darauf.

🟠

Weak cryptographic algorithm detected: ... go-weak-crypto-algorithm

🟠

jwt.verify() without algorithm specification allows 'none' algorithm attack javascript-jwt-algorithm-confusion

🟠

JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that by javascript-jwt-algorithm-confusion

🟠

use of weak or broken cryptographic algorithms for hashing passwords or sensitive data javascript-weak-crypto-algorithm

🟡

use of weak or deprecated cryptographic algorithms like MD5, SHA-1, DES, or RC4 python-weak-crypto-algorithm

🔍

Scanne deine Codebasis nach Use of a Broken or Risky Cryptographic Algorithm

Shoulder CLI findet anfällige Muster in deiner gesamten Codebasis.

npx shoulder trust Alle Regeln durchsuchen