Description

This detector identifies Ruby code using insecure AES cipher modes through the OpenSSL library. It specifically flags cipher modes that are cryptographically weak or deprecated, such as ECB mode which lacks proper randomization and can reveal patterns in encrypted data.

Detection Strategy

• Ruby code imports or uses the OpenSSL library (checks for 'openssl' prefix in imports)

• Code contains method calls or expressions that configure AES cipher modes

• The cipher mode argument uses an insecure AES mode (determined by _is_insecure_aes_mode function)

• The insecure cipher mode is defined or hardcoded in the application code rather than coming from a secure external source

Vulnerable code example

require 'openssl'

def encrypt_data(key, data)
  cipher = OpenSSL::Cipher.new('aes-256-cbc')  # Vulnerable: CBC mode lacks authentication
  cipher.encrypt
  cipher.key = key
  cipher.update(data) + cipher.final
end...

✅ Secure code example

require 'openssl'

def encrypt_data(key, data)
  cipher = OpenSSL::Cipher.new('aes-256-gcm')  # Fixed: GCM mode provides authentication
  cipher.encrypt
  cipher.key = key
  cipher.update(data) + cipher.final
end...