Description

This detector identifies the use of weak or insecure hashing algorithms in HMAC (Hash-based Message Authentication Code) operations within TypeScript code. Using weak hash functions (such as MD5 or SHA-1) in HMAC constructions reduces the cryptographic strength of the authentication code, making it vulnerable to collision attacks and potentially allowing attackers to forge valid MACs or compromise message integrity.

Detection Strategy

• Scans TypeScript source files for HMAC creation or configuration calls where a weak hashing algorithm is specified as the digest/hash parameter (e.g., 'md5', 'sha1', or other cryptographically weak algorithms).

• A vulnerability is reported when an HMAC-related function call or object instantiation is found with a hash algorithm argument that is considered cryptographically weak — specifically algorithms that are known to be vulnerable to collision or preimage attacks.

• Detection triggers on direct string literals passed as the algorithm argument to HMAC APIs (such as Node.js `crypto.createHmac('md5', key)` or similar patterns), where the specified algorithm does not meet current cryptographic strength requirements (i.e., is not a member of the SHA-2 or SHA-3 family).

Vulnerable code example

import { createHmac as hmac } from "node:crypto";
import CryptoJS from "crypto-js";

const crypto = require("crypto");
const { algo } = CryptoJS;

const ALGORITHM: string = "md5";
...

✅ Secure code example

import { createHmac as hmac } from "node:crypto";
import CryptoJS from "crypto-js";

const crypto = require("crypto");
const { algo } = CryptoJS;

const ALGORITHM: string = "sha256"; // Use strong algorithm constant
...