Description

This detector identifies insufficient bcrypt cost factors in Go applications using the golang.org/x/crypto/bcrypt library. Bcrypt with a low cost factor (typically less than 10-12) provides inadequate protection against brute-force attacks, making password hashes vulnerable to being cracked with modern hardware.

Detection Strategy

• The detector first checks if the bcrypt library (golang.org/x/crypto/bcrypt) is imported in the Go source file

• It then identifies calls to the GenerateFromPassword function from the bcrypt library

• For each GenerateFromPassword call, it examines the second argument which represents the cost factor

• A vulnerability is reported when the cost argument is determined to be unsafe (typically a hardcoded value less than the recommended minimum of 10-12)

• The detection only triggers when both the bcrypt import is present and an unsafe cost value is used in GenerateFromPassword calls

Vulnerable code example

package main

import "golang.org/x/crypto/bcrypt"

func hashPassword(password string) ([]byte, error) {
	// Using MinCost makes passwords easy to crack
	return bcrypt.GenerateFromPassword([]byte(password), bcrypt.MinCost)
}

✅ Secure code example

package main

import "golang.org/x/crypto/bcrypt"

func hashPassword(password string) ([]byte, error) {
	// Use DefaultCost (10) or higher for secure password hashing
	return bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
}