Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

Use of a Broken or Risky Cryptographic Algorithm

The product uses a broken or risky cryptographic algorithm or protocol.

Cryptographic algorithms are the backbone of modern information security. Using algorithms that have known weaknesses, such as MD5 or DES, can make it trivial for attackers to defeat the protection.

Prevalência

Alta

Frequentemente explorada

Impacto

Alto

3 regras de severidade alta

Prevenção

Documentada

4 exemplos de correção

2 Prevenção

Como corrigir esta vulnerabilidade

Estratégias de prevenção para Broken Cryptographic Algorithm baseadas em 4 regras de detecção do Shoulder.

🐹 Go Ver tudo Go detalhes →

Use of Weak Cryptographic Algorithm HIGH

Replace MD5/SHA1/DES/RC4 with bcrypt, SHA-256, or AES-GCM

+8 -5 go

- import "crypto/md5"
- 
- func hashPassword(password string) string {
-     hash := md5.Sum([]byte(password))
-     return hex.EncodeToString(hash[:])
+ import "golang.org/x/crypto/bcrypt"
+ 
+ func hashPassword(password string) (string, error) {
+     hash, err := bcrypt.GenerateFromPassword([]byte(password), 12)
+     if err != nil {
+         return "", err
+     }
+     return string(hash), nil
  }

🟨 JavaScript Ver tudo JavaScript detalhes →

JWT Algorithm Confusion Attack HIGH

Always specify allowed algorithms when verifying JWT tokens

+3 -1 javascript

- const decoded = jwt.verify(token, secret);
+ const decoded = jwt.verify(token, secret, {
+   algorithms: ['RS256']
+ });

Use of Weak Cryptographic Algorithm HIGH

Use SHA-256+ for hashing, AES-256-GCM for encryption, and bcrypt for passwords

+1 -1 javascript

- const hash = crypto.createHash('md5').update(data).digest('hex');
+ const hash = crypto.createHash('sha256').update(data).digest('hex');

🐍 Python Ver tudo Python detalhes →

Weak Cryptographic Algorithm MEDIUM

Replace MD5/SHA-1/DES/RC4 with SHA-256/SHA-3 for hashing and AES-GCM for encryption

+1 -1 python

  import hashlib
  
  def verify_integrity(data):
-     return hashlib.md5(data.encode()).hexdigest()
+     return hashlib.sha256(data.encode()).hexdigest()

3 Detecção

Encontre vulnerabilidades no seu código

Use o Shoulder para escanear seu código em busca de padrões Use of a Broken or Risky Cryptographic Algorithm. 4 regras.

terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=327

# Or scan entire project
npx @shoulderdev/cli trust .

Regras de Detecção (4)

🟨 Javascript 2 rules

JWT Algorithm Confusion Attack HIGH

Detects JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that bypass authentication.

Use of Weak Cryptographic Algorithm HIGH

Detects use of weak or broken cryptographic algorithms for hashing passwords or sensitive data. **Weak algorithms detected:** - **MD5**: Cryptographically broken, vulnerable to collision attacks - **SHA1**: Deprecated, vulnerable to collision attacks - **DES/3DES**: Weak block cipher with small key size - **RC4**: Stream cipher with known vulnerabilities **Impact:** - Password hashes can be cracked using rainbow tables or brute force - Data encrypted with weak algorithms can be decrypted by at

🔷 Typescript 2 rules

JWT Algorithm Confusion Attack HIGH

Detects JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that bypass authentication.

Use of Weak Cryptographic Algorithm HIGH

🐹 Go 1 rules

Use of Weak Cryptographic Algorithm HIGH

Uses MD5, SHA1, DES, or RC4 which are cryptographically broken.

🐍 Python 1 rules

Weak Cryptographic Algorithm MEDIUM

Detects use of weak or deprecated cryptographic algorithms like MD5, SHA-1, DES, or RC4. Use modern algorithms like SHA-256, SHA-3, AES, or ChaCha20.

4 Sinais de Alerta

O que observar nas revisões de código

Estes padrões indicam vulnerabilidades potenciais de Use of a Broken or Risky Cryptographic Algorithm. Procure-os durante revisões de código e auditorias de segurança.

🟠

Weak cryptographic algorithm detected: ... go-weak-crypto-algorithm

🟠

jwt.verify() without algorithm specification allows 'none' algorithm attack javascript-jwt-algorithm-confusion

🟠

JWT verification without explicit algorithm specification, allowing "none" algorithm attacks that by javascript-jwt-algorithm-confusion

🟠

use of weak or broken cryptographic algorithms for hashing passwords or sensitive data javascript-weak-crypto-algorithm

🟡

use of weak or deprecated cryptographic algorithms like MD5, SHA-1, DES, or RC4 python-weak-crypto-algorithm

🔍

Escaneie seu código para Use of a Broken or Risky Cryptographic Algorithm

O Shoulder CLI encontra padrões vulneráveis em todo o seu código.

npx shoulder trust Ver todas as regras