Description

This detector identifies the use of predictable or static salt values in Key Derivation Function (KDF) calls within JavaScript code. Using a predictable or hardcoded salt weakens the cryptographic strength of the derived key, making it vulnerable to precomputation attacks (e.g., rainbow tables) and reducing the security guarantees of the KDF.

Detection Strategy

• Scans JavaScript source files for calls to Key Derivation Functions (KDFs) such as PBKDF2, scrypt, bcrypt, or similar cryptographic key derivation APIs.

• Inspects the salt argument passed to the KDF call and checks whether it is a static, hardcoded, or otherwise predictable value (e.g., a string literal, numeric constant, or fixed buffer) rather than a cryptographically random value generated at runtime.

• A vulnerability is reported when a KDF invocation is found where the salt parameter is determined to be non-random or predictable, meaning it does not originate from a secure random source like crypto.randomBytes() or an equivalent runtime-generated value.

Vulnerable code example

import { pbkdf2Sync as derivePbkdf2Sync } from "node:crypto";

export function hashPassword(password) {
  return derivePbkdf2Sync(password, "static-salt", 210000, 64, "sha512"); // static salt is hardcoded, never changes
}

✅ Secure code example

import { pbkdf2Sync as derivePbkdf2Sync, randomBytes } from "node:crypto";

export function hashPassword(password) {
  const salt = randomBytes(16); // generate a unique random salt per password
  const hash = derivePbkdf2Sync(password, salt, 210000, 64, "sha512");
  return `${salt.toString("hex")}:${hash.toString("hex")}`;
}