Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
Cryptographic algorithms are the backbone of modern information security. Using algorithms that have known weaknesses, such as MD5 or DES, can make it trivial for attackers to defeat the protection.
普及度
高
頻繁に悪用される
影響度
ハイ
3 件の重大度ハイのルール
予防
文書化済み
4 件の修正例
2 予防
2 予防
この脆弱性の修正方法
4 件の Shoulder 検出ルールに基づく Broken Cryptographic Algorithm の予防策。
Use of Weak Cryptographic Algorithm
HIGH
Replace MD5/SHA1/DES/RC4 with bcrypt, SHA-256, or AES-GCM
- import "crypto/md5" - - func hashPassword(password string) string { - hash := md5.Sum([]byte(password)) - return hex.EncodeToString(hash[:]) + import "golang.org/x/crypto/bcrypt" + + func hashPassword(password string) (string, error) { + hash, err := bcrypt.GenerateFromPassword([]byte(password), 12) + if err != nil { + return "", err + } + return string(hash), nil }
JavaScript
すべて表示 JavaScript 詳細 →
JWT Algorithm Confusion Attack
HIGH
Always specify allowed algorithms when verifying JWT tokens
- const decoded = jwt.verify(token, secret); + const decoded = jwt.verify(token, secret, { + algorithms: ['RS256'] + });
Use of Weak Cryptographic Algorithm
HIGH
Use SHA-256+ for hashing, AES-256-GCM for encryption, and bcrypt for passwords
- const hash = crypto.createHash('md5').update(data).digest('hex'); + const hash = crypto.createHash('sha256').update(data).digest('hex');
Python
すべて表示 Python 詳細 →
Weak Cryptographic Algorithm
MEDIUM
Replace MD5/SHA-1/DES/RC4 with SHA-256/SHA-3 for hashing and AES-GCM for encryption
import hashlib def verify_integrity(data): - return hashlib.md5(data.encode()).hexdigest() + return hashlib.sha256(data.encode()).hexdigest()
3 検出
3 検出
コードの脆弱性を見つける
Shoulderを使用してコードのUse of a Broken or Risky Cryptographic Algorithmパターンをスキャンしましょう。 4 ルール.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=327 # Or scan entire project npx @shoulderdev/cli trust .
検出ルール (4)
🟨
Javascript
2 rules
JWT Algorithm Confusion Attack
HIGH
Detects JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that bypass authentication.
Use of Weak Cryptographic Algorithm
HIGH
Detects use of weak or broken cryptographic algorithms for hashing passwords
or sensitive data.
**Weak algorithms detected:**
- **MD5**: Cryptographically broken, vulnerable to collision attacks
- **SHA1**: Deprecated, vulnerable to collision attacks
- **DES/3DES**: Weak block cipher with small key size
- **RC4**: Stream cipher with known vulnerabilities
**Impact:**
- Password hashes can be cracked using rainbow tables or brute force
- Data encrypted with weak algorithms can be decrypted by at
🔷
Typescript
2 rules
JWT Algorithm Confusion Attack
HIGH
Detects JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that bypass authentication.
Use of Weak Cryptographic Algorithm
HIGH
Detects use of weak or broken cryptographic algorithms for hashing passwords
or sensitive data.
**Weak algorithms detected:**
- **MD5**: Cryptographically broken, vulnerable to collision attacks
- **SHA1**: Deprecated, vulnerable to collision attacks
- **DES/3DES**: Weak block cipher with small key size
- **RC4**: Stream cipher with known vulnerabilities
**Impact:**
- Password hashes can be cracked using rainbow tables or brute force
- Data encrypted with weak algorithms can be decrypted by at
🐹
Go
1 rules
4 警告サイン
4 警告サイン
コードレビューで注目すべき点
これらのパターンはUse of a Broken or Risky Cryptographic Algorithmの潜在的な脆弱性を示しています。コードレビューとセキュリティ監査中に探してください。
Weak cryptographic algorithm detected: ...
go-weak-crypto-algorithm
jwt.verify() without algorithm specification allows 'none' algorithm attack
javascript-jwt-algorithm-confusion
JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that by
javascript-jwt-algorithm-confusion
use of weak or broken cryptographic algorithms for hashing passwords
or sensitive data
javascript-weak-crypto-algorithm
use of weak or deprecated cryptographic algorithms like MD5, SHA-1,
DES, or RC4
python-weak-crypto-algorithm
コードベースをスキャン: Use of a Broken or Risky Cryptographic Algorithm
Shoulder CLI はコードベース全体から脆弱なパターンを見つけます。