Description

Detects usage of CryptoJS encryption functions that rely on passphrase-based key derivation instead of proper cryptographic keys. This creates weak encryption since passphrases typically have low entropy and are vulnerable to brute force attacks, making the encrypted data easier to compromise.

Detection Strategy

• Scans JavaScript code for CryptoJS encryption method calls (such as AES.encrypt, DES.encrypt, etc.)

• Identifies when these encryption methods are called with string passphrases instead of proper cryptographic key objects

• Reports vulnerabilities when CryptoJS encryption functions use passphrase-based encryption mode, which provides weaker security than key-based encryption

Vulnerable code example

import CryptoJS from "crypto-js";

function encryptUserData(userData) {
    const encrypted = CryptoJS.AES.encrypt(userData, "myPassword123"); // Weak: uses MD5-based key derivation
    return encrypted.toString();
}

function decryptUserData(encryptedData) {...

✅ Secure code example

import CryptoJS from "crypto-js";

function encryptUserData(userData, password) {
    const salt = CryptoJS.lib.WordArray.random(128 / 8);
    const key = CryptoJS.PBKDF2(password, salt, {
        keySize: 512 / 32,
        iterations: 150000
    });...