Description

This vulnerability detector identifies PHP code that uses predictable initialization vectors (IV) or nonces in cryptographic operations. Predictable IVs/nonces can compromise the security of encryption algorithms, making encrypted data vulnerable to cryptographic attacks.

Detection Strategy

• Scans all selected nodes in PHP source code files

• Identifies OpenSSL function calls that use predictable initialization vectors through pattern analysis

• When phpseclib cryptographic library is imported, also checks for cipher object method calls that use predictable parameters

• Reports a vulnerability when cryptographic functions are called with non-random or predictable IV/nonce values that could weaken encryption security

Vulnerable code example

<?php
use phpseclib3\Crypt\AES;

function encryptData($data, $key) {
    // VULNERABLE: time() is predictable - attackers can guess encryption time
    return openssl_encrypt($data, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, time());
}
...

✅ Secure code example

<?php
use phpseclib3\Crypt\AES;

function encryptData($data, $key) {
    // SAFE: random_bytes() provides cryptographically secure random IV
    $iv = random_bytes(openssl_cipher_iv_length('aes-256-cbc'));
    return openssl_encrypt($data, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
}...