Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

Use of a Broken or Risky Cryptographic Algorithm

The product uses a broken or risky cryptographic algorithm or protocol.

Cryptographic algorithms are the backbone of modern information security. Using algorithms that have known weaknesses, such as MD5 or DES, can make it trivial for attackers to defeat the protection.

Prévalence

Élevée

Fréquemment exploitée

Impact

Élevé

3 règles de sévérité élevée

Prévention

Documentée

4 exemples de correctifs

2 Prévention

Comment corriger cette vulnérabilité

Stratégies de prévention pour Broken Cryptographic Algorithm basées sur 4 règles de détection Shoulder.

🐹 Go Tout voir Go détails →

Use of Weak Cryptographic Algorithm HIGH

Replace MD5/SHA1/DES/RC4 with bcrypt, SHA-256, or AES-GCM

+8 -5 go

- import "crypto/md5"
- 
- func hashPassword(password string) string {
-     hash := md5.Sum([]byte(password))
-     return hex.EncodeToString(hash[:])
+ import "golang.org/x/crypto/bcrypt"
+ 
+ func hashPassword(password string) (string, error) {
+     hash, err := bcrypt.GenerateFromPassword([]byte(password), 12)
+     if err != nil {
+         return "", err
+     }
+     return string(hash), nil
  }

🟨 JavaScript Tout voir JavaScript détails →

JWT Algorithm Confusion Attack HIGH

Always specify allowed algorithms when verifying JWT tokens

+3 -1 javascript

- const decoded = jwt.verify(token, secret);
+ const decoded = jwt.verify(token, secret, {
+   algorithms: ['RS256']
+ });

Use of Weak Cryptographic Algorithm HIGH

Use SHA-256+ for hashing, AES-256-GCM for encryption, and bcrypt for passwords

+1 -1 javascript

- const hash = crypto.createHash('md5').update(data).digest('hex');
+ const hash = crypto.createHash('sha256').update(data).digest('hex');

🐍 Python Tout voir Python détails →

Weak Cryptographic Algorithm MEDIUM

Replace MD5/SHA-1/DES/RC4 with SHA-256/SHA-3 for hashing and AES-GCM for encryption

+1 -1 python

  import hashlib
  
  def verify_integrity(data):
-     return hashlib.md5(data.encode()).hexdigest()
+     return hashlib.sha256(data.encode()).hexdigest()

3 Détection

Trouvez les vulnérabilités dans votre code

Utilisez Shoulder pour scanner votre code à la recherche de patterns Use of a Broken or Risky Cryptographic Algorithm. 4 règles.

terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=327

# Or scan entire project
npx @shoulderdev/cli trust .

Règles de Détection (4)

🟨 Javascript 2 rules

JWT Algorithm Confusion Attack HIGH

Detects JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that bypass authentication.

Use of Weak Cryptographic Algorithm HIGH

Detects use of weak or broken cryptographic algorithms for hashing passwords or sensitive data. **Weak algorithms detected:** - **MD5**: Cryptographically broken, vulnerable to collision attacks - **SHA1**: Deprecated, vulnerable to collision attacks - **DES/3DES**: Weak block cipher with small key size - **RC4**: Stream cipher with known vulnerabilities **Impact:** - Password hashes can be cracked using rainbow tables or brute force - Data encrypted with weak algorithms can be decrypted by at

🔷 Typescript 2 rules

JWT Algorithm Confusion Attack HIGH

Detects JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that bypass authentication.

Use of Weak Cryptographic Algorithm HIGH

🐹 Go 1 rules

Use of Weak Cryptographic Algorithm HIGH

Uses MD5, SHA1, DES, or RC4 which are cryptographically broken.

🐍 Python 1 rules

Weak Cryptographic Algorithm MEDIUM

Detects use of weak or deprecated cryptographic algorithms like MD5, SHA-1, DES, or RC4. Use modern algorithms like SHA-256, SHA-3, AES, or ChaCha20.

4 Signes d'Alerte

Ce qu'il faut surveiller lors des revues de code

Ces patterns indiquent des vulnérabilités potentielles Use of a Broken or Risky Cryptographic Algorithm. Recherchez-les lors des revues de code et des audits de sécurité.

🟠

Weak cryptographic algorithm detected: ... go-weak-crypto-algorithm

🟠

jwt.verify() without algorithm specification allows 'none' algorithm attack javascript-jwt-algorithm-confusion

🟠

JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that by javascript-jwt-algorithm-confusion

🟠

use of weak or broken cryptographic algorithms for hashing passwords or sensitive data javascript-weak-crypto-algorithm

🟡

use of weak or deprecated cryptographic algorithms like MD5, SHA-1, DES, or RC4 python-weak-crypto-algorithm

🔍

Scannez votre base de code pour Use of a Broken or Risky Cryptographic Algorithm

Shoulder CLI trouve les motifs vulnérables dans toute votre base de code.

npx shoulder trust Parcourir toutes les règles