Description

This detector identifies CryptoJS PBKDF2 implementations that use predictable or weak salts. Using predictable salts in password-based key derivation functions significantly reduces security as attackers can precompute rainbow tables or use known salt values to crack passwords more efficiently.

Detection Strategy

• Reports vulnerabilities when JavaScript code uses CryptoJS PBKDF2 functions with predictable, hardcoded, or weak salt values

• Triggers when salt parameters are static strings, easily guessable values, or insufficient randomness sources

• Identifies cases where salt generation lacks proper entropy or uses deterministic patterns that compromise cryptographic security

Vulnerable code example

import PBKDF2 from "crypto-js/pbkdf2";
const CryptoJS = require("crypto-js");

const PASSWORD_SALT = "app-static-salt-2024"; // Hardcoded salt is predictable

export function hashPassword(password) {
  return CryptoJS.PBKDF2(password, PASSWORD_SALT, {
    keySize: 256 / 32,...

✅ Secure code example

import PBKDF2 from "crypto-js/pbkdf2";
const CryptoJS = require("crypto-js");

export function hashPassword(password) {
  const salt = CryptoJS.lib.WordArray.random(16); // Generate random salt for each hash
  const hash = CryptoJS.PBKDF2(password, salt, {
    keySize: 256 / 32,
    iterations: 210000,...