logo

Database

Typescript Rsa Legacy Padding

Description

This vulnerability detector identifies the use of insecure RSA legacy padding schemes in TypeScript code. Legacy padding methods like PKCS#1 v1.5 are vulnerable to padding oracle attacks and other cryptographic weaknesses that can lead to data decryption or signature forgery.

Weakness:

052 - Insecure encryption algorithm

Category: Information Collection

Detection Strategy

    • Scans TypeScript source files for RSA cryptographic operations

    • Identifies function calls or configurations that specify RSA padding schemes

    • Reports vulnerabilities when legacy or insecure padding methods (like PKCS#1 v1.5) are detected instead of secure alternatives like OAEP

    • Triggers on cryptographic library usage where RSA padding is explicitly set to vulnerable options

Vulnerable code example

import { constants, privateDecrypt, publicEncrypt } from "crypto";

function encryptWithPkcs1Padding(data: Buffer, publicKey: string): Buffer {
  // VULNERABLE: Uses legacy RSA_PKCS1_PADDING susceptible to padding oracle attacks
  return publicEncrypt({ key: publicKey, padding: constants.RSA_PKCS1_PADDING }, data);
}

function decryptWithPkcs1PaddingVariable(data: Buffer, privateKey: string): Buffer {...

✅ Secure code example

import { constants, privateDecrypt, publicEncrypt } from "crypto";

function encryptWithPkcs1Padding(data: Buffer, publicKey: string): Buffer {
  // SAFE: Uses RSA_PKCS1_OAEP_PADDING to prevent padding oracle attacks
  return publicEncrypt({ key: publicKey, padding: constants.RSA_PKCS1_OAEP_PADDING }, data);
}

function decryptWithPkcs1PaddingVariable(data: Buffer, privateKey: string): Buffer {...