Description

This detector identifies the use of predictable or hardcoded salt values in Key Derivation Function (KDF) calls within TypeScript code. Using a static, predictable, or hardcoded salt weakens the cryptographic strength of derived keys, making them susceptible to precomputation attacks (e.g., rainbow tables) and reducing the security guarantees of the KDF.

Detection Strategy

• Scans TypeScript source files for calls to Key Derivation Functions (e.g., PBKDF2, scrypt, bcrypt, Argon2, or similar KDF APIs) and inspects the salt argument passed to those calls.

• A vulnerability is reported when the salt value provided to a KDF call is a hardcoded literal (e.g., a string constant, numeric literal, or fixed byte array), a statically predictable value, or an empty/null value — rather than a cryptographically random value generated at runtime.

• The issue is flagged at the specific location in the code where the KDF function is invoked with the insecure salt, pointing directly to the argument or expression used as the salt.

Vulnerable code example

import * as crypto from "crypto";
import { pbkdf2 as derivePbkdf2, scrypt } from "node:crypto";

const PASSWORD_SALT: string = "app-static-salt-2024"; // hardcoded static salt

export function hashPassword(password: string): string {
  return crypto.pbkdf2Sync(password, PASSWORD_SALT, 210000, 64, "sha512").toString("hex"); // static salt
}...

✅ Secure code example

import * as crypto from "crypto";
import { pbkdf2 as derivePbkdf2, scrypt } from "node:crypto";

// No static salt — each call generates a unique cryptographic salt
export function hashPassword(password: string): string {
  const salt = crypto.randomBytes(16).toString("hex");
  return `${salt}:${crypto.pbkdf2Sync(password, salt, 210000, 64, "sha512").toString("hex")}`;
}...