Description

Detects the use of the weak Blowfish encryption cipher in Ruby applications using the OpenSSL library. Blowfish is considered cryptographically weak due to its small block size (64-bit) which makes it vulnerable to birthday attacks, especially in protocols like HTTPS.

Detection Strategy

• Check if the OpenSSL library is imported in the Ruby code

• Look for OpenSSL::Cipher.new() method calls

• Examine if the cipher parameter passed to Cipher.new() specifies 'blowfish' or related weak cipher variants

• Report a vulnerability when Blowfish cipher initialization is detected

Vulnerable code example

require 'openssl'

cipher = OpenSSL::Cipher.new('blowfish')  # Vulnerable: using obsolete and insecure Blowfish cipher
data = cipher.encrypt(input)  # Using the insecure cipher for encryption

✅ Secure code example

require 'openssl'

# Use AES-256-GCM for authenticated encryption
cipher = OpenSSL::Cipher.new('AES-256-GCM')  # Safe: Using strong AEAD cipher
cipher.encrypt
key = cipher.random_key  # Generate secure random key
iv = cipher.random_iv    # Generate secure random IV
encrypted = cipher.update(input) + cipher.final...