Description

This detector identifies insecure AES cipher mode configurations in C# code. Using weak cipher modes like ECB (Electronic Codebook) makes encrypted data vulnerable to pattern analysis attacks, as identical plaintext blocks produce identical ciphertext blocks, potentially exposing sensitive information.

Detection Strategy

• Scans C# source code for AES cipher mode assignments and configurations

• Analyzes variable assignments, property settings, and constructor parameters that specify AES cipher modes

• Reports vulnerabilities when insecure cipher modes (typically ECB mode) are explicitly configured

• Triggers when code assigns weak cipher modes to AES encryption objects or properties

• Focuses on CipherMode enum values and related encryption configuration patterns

Vulnerable code example

using System.Security.Cryptography;

public class TokenCipher
{
    public byte[] EncryptToken(byte[] key, byte[] msg)
    {
        Aes aes = Aes.Create();
        aes.Key = key;...

✅ Secure code example

using System.Security.Cryptography;

public class TokenCipher
{
    public byte[] EncryptToken(byte[] key, byte[] msg)
    {
        using var gcm = new AesGcm(key, 16); // Safe: AesGcm provides authenticated encryption
        byte[] nonce = new byte[12];...