Description

This vulnerability detector identifies instances where PBKDF2 (Password-Based Key Derivation Function 2) implementations use predictable or hardcoded salt values in JavaScript code. Using predictable salts makes password hashing vulnerable to rainbow table attacks and reduces the security effectiveness of the key derivation process.

Detection Strategy

• Scans JavaScript source code for PBKDF2 function calls and implementations

• Identifies when salt parameters are hardcoded string literals, static values, or predictable patterns

• Flags PBKDF2 usage where the salt is not generated using cryptographically secure random methods

• Reports vulnerabilities when salt values can be determined at code analysis time rather than being dynamically generated

Vulnerable code example

const forge = require("node-forge");

const STATIC_SALT = "my-app-salt"; // Hardcoded salt - security risk

function hashPassword(password) {
  // Using hardcoded salt makes rainbow table attacks easier
  const key = forge.pkcs5.pbkdf2(password, STATIC_SALT, 10000, 32, "sha256");
  return forge.util.bytesToHex(key);...

✅ Secure code example

const forge = require("node-forge");

function hashPassword(password) {
  // Generate cryptographically secure random salt for each password
  const salt = forge.random.getBytesSync(16);
  const key = forge.pkcs5.pbkdf2(password, salt, 210000, 32, "sha256");
  // Return salt:hash format to store both values
  return `${forge.util.bytesToHex(salt)}:${forge.util.bytesToHex(key)}`;...