Description

This detector identifies TypeScript code that uses CryptoJS with predictable or weak salts in PBKDF2 operations. Using predictable salts in PBKDF2 undermines the security benefits of key derivation, making passwords vulnerable to rainbow table and dictionary attacks.

Detection Strategy

• Scans TypeScript source files for CryptoJS PBKDF2 function calls

• Analyzes the salt parameter passed to PBKDF2 operations

• Reports vulnerabilities when the salt is predictable (hardcoded strings, empty strings, or other non-random values)

• Triggers when salt values can be determined at static analysis time rather than being cryptographically random

Vulnerable code example

import * as CryptoJS from "crypto-js";

const STATIC_SALT = "my-app-salt"; // Hard-coded salt - predictable across users

function hashPassword(password: string): string {
  return CryptoJS.PBKDF2(password, STATIC_SALT, {
    keySize: 256 / 32,
    iterations: 100000...

✅ Secure code example

import * as CryptoJS from "crypto-js";

function hashPassword(password: string): string {
  const salt = CryptoJS.lib.WordArray.random(16); // Generate cryptographically secure random salt
  const hash = CryptoJS.PBKDF2(password, salt, {
    keySize: 256 / 32,
    iterations: 210000, // Increased iterations for better security
    hasher: CryptoJS.algo.SHA512...