Description

This vulnerability detector identifies usage of predictable or weak salts in scrypt.js password hashing operations. Using predictable salts (like hardcoded strings, sequential numbers, or user-provided data without proper randomization) significantly weakens the security of password hashes and makes them vulnerable to rainbow table attacks and other cryptographic attacks.

Detection Strategy

• Scan TypeScript code for imports or usage of the scrypt.js library

• Identify function calls to scrypt hashing methods (like scrypt(), scryptSync(), or similar password hashing functions)

• Analyze the salt parameter passed to these scrypt functions

• Flag cases where the salt is a hardcoded string literal, predictable value, or derived from user input without proper randomization

• Report vulnerability when scrypt functions use non-random or predictable salt values that compromise the cryptographic security of password hashing

Vulnerable code example

import * as scryptJs from "scrypt-js";

export function hashPassword(password: string): string {
  const PASSWORD_SALT: Buffer = Buffer.from("app-static-salt-2024"); // Hardcoded salt is predictable
  const key: Uint8Array = scryptJs.syncScrypt(
    Buffer.from(password.normalize("NFKC")),
    PASSWORD_SALT, // Vulnerable: static salt allows rainbow table attacks
    32768,...

✅ Secure code example

import * as scryptJs from "scrypt-js";
import { randomBytes } from "node:crypto";

export function hashPassword(password: string): string {
  const salt: Buffer = randomBytes(16); // Generate random salt for each hash
  const key: Uint8Array = scryptJs.syncScrypt(
    Buffer.from(password.normalize("NFKC")),
    salt,...