Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.
Cryptographic algorithms are the backbone of modern information security. Using algorithms that have known weaknesses, such as MD5 or DES, can make it trivial for attackers to defeat the protection.
보급률
높음
자주 악용됨
영향
높음
3개의 높은 심각도 규칙
예방
문서화됨
4개의 수정 예시
2 예방
2 예방
이 취약점을 수정하는 방법
4개의 Shoulder 탐지 규칙을 기반으로 한 Broken Cryptographic Algorithm 예방 전략.
Use of Weak Cryptographic Algorithm
HIGH
Replace MD5/SHA1/DES/RC4 with bcrypt, SHA-256, or AES-GCM
- import "crypto/md5" - - func hashPassword(password string) string { - hash := md5.Sum([]byte(password)) - return hex.EncodeToString(hash[:]) + import "golang.org/x/crypto/bcrypt" + + func hashPassword(password string) (string, error) { + hash, err := bcrypt.GenerateFromPassword([]byte(password), 12) + if err != nil { + return "", err + } + return string(hash), nil }
JavaScript
모두 보기 JavaScript 자세히 →
JWT Algorithm Confusion Attack
HIGH
Always specify allowed algorithms when verifying JWT tokens
- const decoded = jwt.verify(token, secret); + const decoded = jwt.verify(token, secret, { + algorithms: ['RS256'] + });
Use of Weak Cryptographic Algorithm
HIGH
Use SHA-256+ for hashing, AES-256-GCM for encryption, and bcrypt for passwords
- const hash = crypto.createHash('md5').update(data).digest('hex'); + const hash = crypto.createHash('sha256').update(data).digest('hex');
Python
모두 보기 Python 자세히 →
Weak Cryptographic Algorithm
MEDIUM
Replace MD5/SHA-1/DES/RC4 with SHA-256/SHA-3 for hashing and AES-GCM for encryption
import hashlib def verify_integrity(data): - return hashlib.md5(data.encode()).hexdigest() + return hashlib.sha256(data.encode()).hexdigest()
3 탐지
3 탐지
코드에서 취약점 찾기
Shoulder를 사용하여 코드에서 Use of a Broken or Risky Cryptographic Algorithm 패턴을 스캔하세요. 4 규칙.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=327 # Or scan entire project npx @shoulderdev/cli trust .
탐지 규칙 (4)
🟨
Javascript
2 rules
JWT Algorithm Confusion Attack
HIGH
Detects JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that bypass authentication.
Use of Weak Cryptographic Algorithm
HIGH
Detects use of weak or broken cryptographic algorithms for hashing passwords
or sensitive data.
**Weak algorithms detected:**
- **MD5**: Cryptographically broken, vulnerable to collision attacks
- **SHA1**: Deprecated, vulnerable to collision attacks
- **DES/3DES**: Weak block cipher with small key size
- **RC4**: Stream cipher with known vulnerabilities
**Impact:**
- Password hashes can be cracked using rainbow tables or brute force
- Data encrypted with weak algorithms can be decrypted by at
🔷
Typescript
2 rules
JWT Algorithm Confusion Attack
HIGH
Detects JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that bypass authentication.
Use of Weak Cryptographic Algorithm
HIGH
Detects use of weak or broken cryptographic algorithms for hashing passwords
or sensitive data.
**Weak algorithms detected:**
- **MD5**: Cryptographically broken, vulnerable to collision attacks
- **SHA1**: Deprecated, vulnerable to collision attacks
- **DES/3DES**: Weak block cipher with small key size
- **RC4**: Stream cipher with known vulnerabilities
**Impact:**
- Password hashes can be cracked using rainbow tables or brute force
- Data encrypted with weak algorithms can be decrypted by at
🐹
Go
1 rules
4 경고 신호
4 경고 신호
코드 리뷰에서 주의할 점
이 패턴은 잠재적인 Use of a Broken or Risky Cryptographic Algorithm 취약점을 나타냅니다. 코드 리뷰와 보안 감사 중에 찾아보세요.
Weak cryptographic algorithm detected: ...
go-weak-crypto-algorithm
jwt.verify() without algorithm specification allows 'none' algorithm attack
javascript-jwt-algorithm-confusion
JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that by
javascript-jwt-algorithm-confusion
use of weak or broken cryptographic algorithms for hashing passwords
or sensitive data
javascript-weak-crypto-algorithm
use of weak or deprecated cryptographic algorithms like MD5, SHA-1,
DES, or RC4
python-weak-crypto-algorithm
코드베이스를 스캔하세요: Use of a Broken or Risky Cryptographic Algorithm
Shoulder CLI는 전체 코드베이스에서 취약한 패턴을 찾아냅니다.