Description

Detects insecure usage of PHP's AES-128-CBC encryption through openssl_encrypt and openssl_decrypt functions. When these functions are used with weak parameters or predictable values, it can lead to vulnerable encryption that may be broken by attackers, potentially exposing sensitive data.

Detection Strategy

• Identifies calls to PHP's openssl_encrypt or openssl_decrypt functions in the code

• Examines the arguments passed to these functions to check for insecure parameters

• Reports a vulnerability when the encryption functions are called with predictable or static initialization vectors (IVs), weak keys, or insecure cipher modes

Vulnerable code example

$data = "Sensitive Information";
$key = "secretkey";

// Vulnerability 1: Using weak AES-128-CBC encryption algorithm
$method = "AES-128-CBC";  // Insecure: uses 128-bit key length
$iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length($method));
$encrypted = openssl_encrypt($data, $method, $key, OPENSSL_RAW_DATA, $iv);
...

✅ Secure code example

$data = "Sensitive Information";

// Generate a cryptographically secure key with sufficient length
$key = random_bytes(32);  // 256-bit key for AES-256

// Use strong AES-256-GCM encryption algorithm
$method = "aes-256-gcm";  // More secure: uses 256-bit key + authentication
...