Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

Use of a Broken or Risky Cryptographic Algorithm

The product uses a broken or risky cryptographic algorithm or protocol.

Cryptographic algorithms are the backbone of modern information security. Using algorithms that have known weaknesses, such as MD5 or DES, can make it trivial for attackers to defeat the protection.

Prevalencia

Alta

Frecuentemente explotada

Impacto

Alto

3 reglas de severidad alta

Prevención

Documentada

4 ejemplos de corrección

2 Prevención

Cómo corregir esta vulnerabilidad

Estrategias de prevención para Broken Cryptographic Algorithm basadas en 4 reglas de detección de Shoulder.

🐹 Go Ver todo Go detalles →

Use of Weak Cryptographic Algorithm HIGH

Replace MD5/SHA1/DES/RC4 with bcrypt, SHA-256, or AES-GCM

+8 -5 go

- import "crypto/md5"
- 
- func hashPassword(password string) string {
-     hash := md5.Sum([]byte(password))
-     return hex.EncodeToString(hash[:])
+ import "golang.org/x/crypto/bcrypt"
+ 
+ func hashPassword(password string) (string, error) {
+     hash, err := bcrypt.GenerateFromPassword([]byte(password), 12)
+     if err != nil {
+         return "", err
+     }
+     return string(hash), nil
  }

🟨 JavaScript Ver todo JavaScript detalles →

JWT Algorithm Confusion Attack HIGH

Always specify allowed algorithms when verifying JWT tokens

+3 -1 javascript

- const decoded = jwt.verify(token, secret);
+ const decoded = jwt.verify(token, secret, {
+   algorithms: ['RS256']
+ });

Use of Weak Cryptographic Algorithm HIGH

Use SHA-256+ for hashing, AES-256-GCM for encryption, and bcrypt for passwords

+1 -1 javascript

- const hash = crypto.createHash('md5').update(data).digest('hex');
+ const hash = crypto.createHash('sha256').update(data).digest('hex');

🐍 Python Ver todo Python detalles →

Weak Cryptographic Algorithm MEDIUM

Replace MD5/SHA-1/DES/RC4 with SHA-256/SHA-3 for hashing and AES-GCM for encryption

+1 -1 python

  import hashlib
  
  def verify_integrity(data):
-     return hashlib.md5(data.encode()).hexdigest()
+     return hashlib.sha256(data.encode()).hexdigest()

3 Detección

Encuentra vulnerabilidades en tu código

Usa Shoulder para escanear tu código en busca de patrones Use of a Broken or Risky Cryptographic Algorithm. 4 reglas.

terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=327

# Or scan entire project
npx @shoulderdev/cli trust .

Reglas de Detección (4)

🟨 Javascript 2 rules

JWT Algorithm Confusion Attack HIGH

Detects JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that bypass authentication.

Use of Weak Cryptographic Algorithm HIGH

Detects use of weak or broken cryptographic algorithms for hashing passwords or sensitive data. **Weak algorithms detected:** - **MD5**: Cryptographically broken, vulnerable to collision attacks - **SHA1**: Deprecated, vulnerable to collision attacks - **DES/3DES**: Weak block cipher with small key size - **RC4**: Stream cipher with known vulnerabilities **Impact:** - Password hashes can be cracked using rainbow tables or brute force - Data encrypted with weak algorithms can be decrypted by at

🔷 Typescript 2 rules

JWT Algorithm Confusion Attack HIGH

Detects JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that bypass authentication.

Use of Weak Cryptographic Algorithm HIGH

🐹 Go 1 rules

Use of Weak Cryptographic Algorithm HIGH

Uses MD5, SHA1, DES, or RC4 which are cryptographically broken.

🐍 Python 1 rules

Weak Cryptographic Algorithm MEDIUM

Detects use of weak or deprecated cryptographic algorithms like MD5, SHA-1, DES, or RC4. Use modern algorithms like SHA-256, SHA-3, AES, or ChaCha20.

4 Señales de Alerta

Qué buscar en las revisiones de código

Estos patrones indican vulnerabilidades potenciales de Use of a Broken or Risky Cryptographic Algorithm. Búscalos durante las revisiones de código y auditorías de seguridad.

🟠

Weak cryptographic algorithm detected: ... go-weak-crypto-algorithm

🟠

jwt.verify() without algorithm specification allows 'none' algorithm attack javascript-jwt-algorithm-confusion

🟠

JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that by javascript-jwt-algorithm-confusion

🟠

use of weak or broken cryptographic algorithms for hashing passwords or sensitive data javascript-weak-crypto-algorithm

🟡

use of weak or deprecated cryptographic algorithms like MD5, SHA-1, DES, or RC4 python-weak-crypto-algorithm

🔍

Escanea tu base de código para Use of a Broken or Risky Cryptographic Algorithm

Shoulder CLI encuentra patrones vulnerables en toda tu base de código.

npx shoulder trust Ver todas las reglas