Description

This detector identifies the use of weak or insecure hashing algorithms in HMAC (Hash-based Message Authentication Code) operations within JavaScript code. Using weak hash functions (such as MD5 or SHA-1) in HMAC constructions reduces the cryptographic strength of the authentication code, making it vulnerable to collision attacks and potentially allowing attackers to forge message authentication codes.

Detection Strategy

• Scans JavaScript source files for HMAC creation calls or cryptographic API invocations where the hashing algorithm parameter is set to a known weak or insecure algorithm (e.g., MD5, SHA1, SHA-128).

• A vulnerability is reported when a function call that constructs or configures an HMAC object is found and the algorithm argument passed to it resolves to a weak hash identifier string, regardless of whether the call uses Node.js built-in crypto modules or third-party cryptographic libraries.

• Only selected candidate call nodes (pre-filtered by method supplies) are evaluated, meaning the check focuses specifically on HMAC-related function invocations rather than all cryptographic usage in the file.

Vulnerable code example

import { createHmac as hmac } from "node:crypto";
import CryptoJS from "crypto-js";

const crypto = require("crypto");
const { algo } = CryptoJS;

const ALGORITHM = "md5";
...

✅ Secure code example

import { createHmac as hmac } from "node:crypto";
import CryptoJS from "crypto-js";

const crypto = require("crypto");
const { algo } = CryptoJS;

const ALGORITHM = "sha512"; // Use strong algorithm constant instead of md5
...