Description

This vulnerability detector identifies insecure AES cipher modes in Scala code. When developers use weak cipher modes like ECB (Electronic Code Book), it exposes patterns in encrypted data that can be exploited by attackers to recover plaintext information, compromising data confidentiality.

Detection Strategy

• Scans for method calls to 'getInstance' on the 'Cipher' class in Scala code

• Examines the first argument passed to the getInstance method to determine the cipher transformation

• Reports a vulnerability when the cipher transformation specifies an insecure AES mode (typically ECB mode or other weak configurations)

• Triggers when code patterns like 'Cipher.getInstance("AES/ECB/PKCS5Padding")' are found, indicating use of vulnerable encryption modes

Vulnerable code example

import javax.crypto.Cipher

object VulnerableExample {
  def encryptData(): Cipher = {
    Cipher.getInstance("AES/CBC/NoPadding") // Vulnerable: CBC mode lacks authentication
  }
  
  def encryptSession(): Cipher = {...

✅ Secure code example

import javax.crypto.Cipher

object SecureExample {
  def encryptData(): Cipher = {
    Cipher.getInstance("AES/GCM/NoPadding") // Secure: GCM provides authentication
  }
  
  def encryptSession(): Cipher = {...