Description

Detects usage of insecure AES cipher modes in Go applications that provide weak cryptographic protection. Insecure AES cipher modes like ECB (Electronic Codebook) can expose patterns in encrypted data and make cryptographic attacks feasible, compromising data confidentiality.

Detection Strategy

• Checks if the application imports the crypto/cipher Go package

• Scans for function calls that use AES cipher creation (aes.NewCipher) combined with insecure cipher modes

• Reports vulnerabilities when code uses specific insecure cipher mode suffixes from the crypto/cipher package

• Focuses on cipher mode functions that are known to be cryptographically weak or inappropriate for secure encryption

Vulnerable code example

package main

import (
	"crypto/aes"
	"crypto/cipher"
)

func encryptData(key, iv, plaintext []byte) ([]byte, error) {...

✅ Secure code example

package main

import (
	"crypto/aes"
	"crypto/cipher"
)

func encryptData(key, nonce, plaintext []byte) ([]byte, error) {...