Description

Detects hardcoded passwords used in Java cryptographic implementations, specifically in PBEKeySpec (Password-Based Encryption) and KerberosKey constructors. Using hardcoded passwords in cryptographic operations is a critical security vulnerability as it can lead to credential exposure and system compromise.

Detection Strategy

• Check if code imports javax.crypto.spec.PBEKeySpec or javax.security.auth.kerberos packages

• Look for constructor calls to PBEKeySpec or KerberosKey classes

• Examine the password parameter passed to these constructors

• Report a vulnerability if the password parameter is a hardcoded value (like a string literal) instead of being read from a secure configuration or user input

• Each identified instance of a hardcoded password in these cryptographic constructors is flagged as a security issue

Vulnerable code example

import javax.crypto.spec.PBEKeySpec;
import javax.security.auth.kerberos.*;

public class VulnerablePasswords {
    public void unsafePasswordHandling() {
        byte[] salt = new byte[16];
        int iterations = 1000;
        ...

✅ Secure code example

import javax.crypto.spec.PBEKeySpec;
import javax.security.auth.kerberos.*;

public class SecurePasswords {
    public void safePasswordHandling() {
        byte[] salt = new byte[16];
        int iterations = 20000; // Increased iterations for better security
        ...