Description

This vulnerability detector identifies OpenSSL cipher operations in PHP code that are missing required initialization vectors (IVs). When encryption algorithms require an IV but none is provided, it can lead to weak encryption or cryptographic vulnerabilities that make encrypted data susceptible to attacks.

Detection Strategy

• Identifies OpenSSL cipher function calls in PHP code (such as openssl_encrypt, openssl_decrypt)

• Checks if the cipher operation requires an initialization vector based on the encryption algorithm used

• Reports a vulnerability when a cipher that requires an IV is called without providing one as a parameter

• Focuses on cryptographic functions where missing IVs compromise the security of the encryption scheme

Vulnerable code example

<?php
$key = 'secret_key_123';

// Missing IV parameter for CBC mode - vulnerable to IV reuse attacks
$encrypted = openssl_encrypt($data, 'AES-256-CBC', $key);

// Missing IV parameter for GCM mode - reduces security strength 
$encrypted = openssl_encrypt($data, 'aes-256-gcm', $key);...

✅ Secure code example

<?php
$key = 'secret_key_123';

// Safe - Generate random IV for CBC mode
$iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length('AES-256-CBC'));
$encrypted = openssl_encrypt($data, 'AES-256-CBC', $key, OPENSSL_RAW_DATA, $iv);

// Safe - Generate random IV for GCM mode...