Description

This vulnerability occurs when Rust applications use bcrypt hashing with insufficient computational cost parameters. Low cost values make password hashes vulnerable to brute-force attacks, as they can be computed too quickly by attackers. The detector identifies bcrypt hash function calls with weak cost parameters that don't meet security standards.

Detection Strategy

• The bcrypt crate must be imported in the Rust code

• Code contains calls to bcrypt hashing functions (like bcrypt::hash)

• The cost parameter (second argument) in the bcrypt hash call is present

• The cost parameter value is determined to be insufficient for security (below recommended threshold)

• The cost value can be statically analyzed and confirmed as a weak/low value

Vulnerable code example

use bcrypt::hash;

fn hash_password_low_cost(password: &str) -> String {
    hash(password, 4).unwrap() // Cost 4 is below minimum safe value of 10
}

fn hash_password_low_cost_qualified(password: &str) -> String {
    bcrypt::hash(password, 4).unwrap() // Insufficient cost with qualified name...

✅ Secure code example

use bcrypt::hash;

fn hash_password_low_cost(password: &str) -> String {
    hash(password, 12).unwrap() // Cost 12 meets minimum safe value of 10
}

fn hash_password_low_cost_qualified(password: &str) -> String {
    bcrypt::hash(password, 12).unwrap() // Safe cost with qualified name...