Description

This vulnerability detector identifies the use of insecure AES cipher modes in Rust code. Insecure cipher modes like ECB (Electronic Codebook) can reveal patterns in encrypted data, compromising data confidentiality and potentially allowing attackers to infer information about the plaintext.

Detection Strategy

• The scanner checks if AES-related cryptographic types are imported from specific Rust crates

• It examines expressions in the code that use these imported AES cipher types

• A vulnerability is reported when the expression uses an insecure AES cipher mode (such as ECB mode)

• The detection focuses on method calls or instantiations that create AES ciphers with weak encryption modes

Vulnerable code example

use aes::Aes256;
use cbc::Encryptor;
use openssl::symm::Cipher;

fn vulnerable_encryption() -> Cipher {
    Cipher::aes_256_cbc() // CBC mode without authentication
}
...

✅ Secure code example

use aes_gcm::{Aes256Gcm, KeyInit, Aead, Nonce};
use openssl::symm::Cipher;

fn secure_encryption() -> Cipher {
    Cipher::aes_256_gcm() // GCM mode provides authentication
}

fn another_secure_cipher() -> Aes256Gcm {...