Description

Detects the use of weak or insecure encryption configurations in JavaScript code that could lead to compromised data security. This includes usage of deprecated algorithms, weak cipher modes, or other cryptographically unsafe encryption practices that may expose sensitive data to attacks.

Detection Strategy

• Inspects JavaScript code for encryption-related function calls and configurations

• Identifies when weak or deprecated encryption algorithms are used (e.g., DES, RC4)

• Flags encryption operations using insecure modes of operation (e.g., ECB mode)

• Checks for insufficient key lengths or weak key generation practices in encryption setup

• Reports vulnerabilities when cryptographic configurations don't meet modern security standards

Vulnerable code example

const CryptoJS = require('crypto-js');

// Example of insecure crypto configurations
function insecureCrypto() {
    // Vulnerable: Using insecure ECB mode
    const unsafe1 = CryptoJS.AES.encrypt("data", "key", {
        mode: CryptoJS.mode.ECB  
    });...

✅ Secure code example

const CryptoJS = require('crypto-js');

function secureCrypto() {
    // Generate random IV (16 bytes)
    const iv = CryptoJS.lib.WordArray.random(16);
    
    // Use strong key derivation with random salt
    const salt = CryptoJS.lib.WordArray.random(16);...