Description

This detector identifies the use of the PBKDF2 key derivation function with a predictable or static salt value in JavaScript code. Using a predictable salt in PBKDF2 undermines its security by making it vulnerable to precomputed dictionary/rainbow table attacks, reducing the effectiveness of the password hashing scheme.

Detection Strategy

• Scans for calls to PBKDF2-related functions (e.g., `crypto.pbkdf2`, `pbkdf2Sync`, or equivalent library wrappers) within JavaScript source files.

• Inspects the salt argument passed to the PBKDF2 function call and evaluates whether it is a hardcoded literal (e.g., a string constant, numeric value, or static byte array) rather than a cryptographically random value generated at runtime.

• A vulnerability is reported when the salt parameter is determined to be a predictable, static, or constant value — such as a hardcoded string, empty buffer, or any non-random fixed value — instead of a securely generated random salt (e.g., from `crypto.randomBytes`).

Vulnerable code example

const pbkdf2 = require("pbkdf2");

const PASSWORD_SALT = "app-static-salt-2024"; // hardcoded static salt

function hashPassword(password) {
  return pbkdf2
    .pbkdf2Sync(password, PASSWORD_SALT, 210000, 64, "sha512") // static salt = predictable
    .toString("hex");...

✅ Secure code example

const crypto = require("crypto");
const pbkdf2 = require("pbkdf2");

function hashPassword(password) {
  const salt = crypto.randomBytes(16); // unique cryptographically secure salt per call
  return pbkdf2
    .pbkdf2Sync(password, salt, 210000, 64, "sha512")
    .toString("hex");...