Description

Detects the use of CBC (Cipher Block Chaining) mode encryption in SSH2 SFTP client configurations. CBC mode is vulnerable to padding oracle attacks and lacks authentication, which could allow attackers to perform man-in-the-middle attacks and potentially decrypt sensitive information.

Detection Strategy

• Check if the source code imports or requires the 'ssh2-sftp-client' module

• Search for SFTP client configuration settings or connection options

• Identify if CBC cipher modes are specified in the configuration or connection options

• Report a vulnerability if CBC cipher modes are explicitly configured or used as default

Vulnerable code example

const SftpClient = require('ssh2-sftp-client');

async function connectWithInsecureCipher() {
  const client = new SftpClient();
  
  const config = {
    host: 'sftp.example.com',
    username: 'user',...

✅ Secure code example

const SftpClient = require('ssh2-sftp-client');

async function connectWithSecureCipher() {
  const client = new SftpClient();
  
  const config = {
    host: 'sftp.example.com',
    username: 'user',...