Description

This detector identifies Elixir code that uses weak Base64 encoding for password fields in Ecto schemas. Base64 encoding is not a secure hashing mechanism and passwords encoded this way can be easily decoded, exposing user credentials. This vulnerability poses a significant security risk as it fails to properly protect sensitive authentication data.

Detection Strategy

• Scans Elixir source code files for Ecto schema definitions and database repository operations

• Identifies password-related fields in schemas or database operations that use Base64 encoding functions

• Flags any password field that is encoded with Base64 instead of using proper cryptographic hashing algorithms like bcrypt or argon2

• Reports the vulnerability when Base64 encoding is detected on password fields in repository sinks (database operations)

Vulnerable code example

defmodule UserAuth do
  import Ecto.Changeset
  alias MyApp.Repo

  def register_user(user, password) do
    user
    |> change()
    |> put_change(:password, Base.encode64(password)) # VULNERABLE: Base64 is reversible, not a secure hash...

✅ Secure code example

defmodule UserAuth do
  import Ecto.Changeset
  alias MyApp.Repo

  def register_user(user, password) do
    user
    |> change()
    |> put_change(:password, Bcrypt.hash_pwd_salt(password)) # SAFE: Bcrypt provides one-way cryptographic hashing...