Description

This vulnerability detector identifies the use of predictable or weak salt values in PBKDF2 password hashing implementations in TypeScript code. Using predictable salts makes password hashes vulnerable to rainbow table attacks and reduces the effectiveness of the key derivation function, compromising password security.

Detection Strategy

• The detector scans TypeScript source code for PBKDF2 implementations and analyzes the salt parameter used in password hashing functions

• It triggers a vulnerability report when PBKDF2 functions are called with predictable salt values such as hardcoded strings, empty values, or other weak salt generation patterns

• The vulnerability is flagged specifically when the salt parameter does not use cryptographically secure random generation or when the same salt value could be reused across different password hashing operations

Vulnerable code example

import forge from "node-forge";

const PASSWORD_SALT = "static-salt-123"; // Hardcoded salt - predictable across all users

function hashPassword(password) {
  return forge.pkcs5.pbkdf2(password, PASSWORD_SALT, 10000, 32); // Uses static salt
}
...

✅ Secure code example

import forge from "node-forge";

function hashPassword(password) {
  const salt = forge.random.getBytesSync(16); // Generate random salt for each password
  return forge.pkcs5.pbkdf2(password, salt, 10000, 32);
}

function hashWithTimestamp(password) {...