Description

This vulnerability detects when WebAssembly (WASM) hash functions are using predictable or hardcoded salt values in TypeScript code. Using predictable salts makes password hashes vulnerable to rainbow table attacks and reduces the effectiveness of password hashing security measures.

Detection Strategy

• The detector analyzes TypeScript source code to identify WebAssembly hash function implementations

• It examines hash function calls that use salt parameters in WASM modules

• A vulnerability is reported when salt values are hardcoded, predictable, or use weak randomization methods

• The detection focuses on cryptographic hash functions commonly used for password storage that should use strong, random salts

Vulnerable code example

import { pbkdf2, bcrypt, argon2d, createSHA256 } from "hash-wasm";

const PASSWORD_SALT: string = "app-static-salt-2024"; // Hardcoded salt - predictable

export async function hashPassword(password: string): Promise<string> {
  return pbkdf2({
    password,
    salt: PASSWORD_SALT, // Using static salt for all users...

✅ Secure code example

import { pbkdf2, bcrypt, argon2d, createSHA256 } from "hash-wasm";
import { randomBytes } from "node:crypto";

export async function hashPassword(password: string): Promise<string> {
  const salt = crypto.getRandomValues(new Uint8Array(16)); // Generate random salt per password

  return pbkdf2({
    password,...