Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

Use of a Broken or Risky Cryptographic Algorithm

The product uses a broken or risky cryptographic algorithm or protocol.

Cryptographic algorithms are the backbone of modern information security. Using algorithms that have known weaknesses, such as MD5 or DES, can make it trivial for attackers to defeat the protection.

Rozpowszechnienie

Wysoka

Często wykorzystywana

Wplyw

Wysoki

3 reguł o wysokim poziomie

Zapobieganie

Udokumentowane

4 przykładów poprawek

2 Zapobieganie

Jak naprawić tę podatność

Strategie zapobiegania dla Broken Cryptographic Algorithm oparte na 4 regułach detekcji Shoulder.

🐹 Go Zobacz wszystko Go szczegóły →

Use of Weak Cryptographic Algorithm HIGH

Replace MD5/SHA1/DES/RC4 with bcrypt, SHA-256, or AES-GCM

+8 -5 go

- import "crypto/md5"
- 
- func hashPassword(password string) string {
-     hash := md5.Sum([]byte(password))
-     return hex.EncodeToString(hash[:])
+ import "golang.org/x/crypto/bcrypt"
+ 
+ func hashPassword(password string) (string, error) {
+     hash, err := bcrypt.GenerateFromPassword([]byte(password), 12)
+     if err != nil {
+         return "", err
+     }
+     return string(hash), nil
  }

🟨 JavaScript Zobacz wszystko JavaScript szczegóły →

JWT Algorithm Confusion Attack HIGH

Always specify allowed algorithms when verifying JWT tokens

+3 -1 javascript

- const decoded = jwt.verify(token, secret);
+ const decoded = jwt.verify(token, secret, {
+   algorithms: ['RS256']
+ });

Use of Weak Cryptographic Algorithm HIGH

Use SHA-256+ for hashing, AES-256-GCM for encryption, and bcrypt for passwords

+1 -1 javascript

- const hash = crypto.createHash('md5').update(data).digest('hex');
+ const hash = crypto.createHash('sha256').update(data).digest('hex');

🐍 Python Zobacz wszystko Python szczegóły →

Weak Cryptographic Algorithm MEDIUM

Replace MD5/SHA-1/DES/RC4 with SHA-256/SHA-3 for hashing and AES-GCM for encryption

+1 -1 python

  import hashlib
  
  def verify_integrity(data):
-     return hashlib.md5(data.encode()).hexdigest()
+     return hashlib.sha256(data.encode()).hexdigest()

3 Wykrywanie

Znajdz podatnosci w swoim kodzie

Uzyj Shoulder do skanowania kodu w poszukiwaniu wzorcow Use of a Broken or Risky Cryptographic Algorithm. 4 reguly.

terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=327

# Or scan entire project
npx @shoulderdev/cli trust .

Reguly Wykrywania (4)

🟨 Javascript 2 rules

JWT Algorithm Confusion Attack HIGH

Detects JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that bypass authentication.

Use of Weak Cryptographic Algorithm HIGH

Detects use of weak or broken cryptographic algorithms for hashing passwords or sensitive data. **Weak algorithms detected:** - **MD5**: Cryptographically broken, vulnerable to collision attacks - **SHA1**: Deprecated, vulnerable to collision attacks - **DES/3DES**: Weak block cipher with small key size - **RC4**: Stream cipher with known vulnerabilities **Impact:** - Password hashes can be cracked using rainbow tables or brute force - Data encrypted with weak algorithms can be decrypted by at

🔷 Typescript 2 rules

JWT Algorithm Confusion Attack HIGH

Detects JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that bypass authentication.

Use of Weak Cryptographic Algorithm HIGH

🐹 Go 1 rules

Use of Weak Cryptographic Algorithm HIGH

Uses MD5, SHA1, DES, or RC4 which are cryptographically broken.

🐍 Python 1 rules

Weak Cryptographic Algorithm MEDIUM

Detects use of weak or deprecated cryptographic algorithms like MD5, SHA-1, DES, or RC4. Use modern algorithms like SHA-256, SHA-3, AES, or ChaCha20.

4 Sygnaly Ostrzegawcze

Na co zwracac uwage podczas przegladu kodu

Te wzorce wskazuja na potencjalne podatnosci Use of a Broken or Risky Cryptographic Algorithm. Szukaj ich podczas przegladow kodu i audytow bezpieczenstwa.

🟠

Weak cryptographic algorithm detected: ... go-weak-crypto-algorithm

🟠

jwt.verify() without algorithm specification allows 'none' algorithm attack javascript-jwt-algorithm-confusion

🟠

JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that by javascript-jwt-algorithm-confusion

🟠

use of weak or broken cryptographic algorithms for hashing passwords or sensitive data javascript-weak-crypto-algorithm

🟡

use of weak or deprecated cryptographic algorithms like MD5, SHA-1, DES, or RC4 python-weak-crypto-algorithm

🔍

Przeskanuj swój kod w poszukiwaniu Use of a Broken or Risky Cryptographic Algorithm

Shoulder CLI znajduje podatne wzorce w całym Twoim kodzie.

npx shoulder trust Przeglądaj wszystkie reguły