Description

Detects usage of deprecated mcrypt encryption functions in PHP code which are considered cryptographically weak and insecure. The mcrypt library has been officially deprecated since PHP 7.1 and removed in PHP 7.2 due to using outdated cryptographic standards that may lead to vulnerabilities.

Detection Strategy

• Identifies direct function calls to mcrypt_encrypt or mcrypt_decrypt in PHP code

• Reports each instance where these deprecated cryptographic functions are used

• The code must contain explicit calls to either mcrypt_encrypt() or mcrypt_decrypt() functions to trigger detection

• Each usage of these functions is flagged independently as a security concern

Vulnerable code example

<?php
$data = "secret data";
$key = "mykey123";
$iv = openssl_random_pseudo_bytes(16);

// Vulnerable: Uses deprecated mcrypt with weak DES encryption
$encrypted = mcrypt_encrypt(MCRYPT_DES, $key, $data, MCRYPT_MODE_CBC, $iv);
...

✅ Secure code example

<?php
$data = "secret data";
$keySrc = getenv('APP_KEY') ?: '';  
$key = hash('sha256', $keySrc, true); // Derive 32-byte key from environment variable

// Secure: Use AES-256-GCM with proper IV generation
$iv = random_bytes(openssl_cipher_iv_length('aes-256-gcm'));
$tag = '';  // Will store authentication tag...