Description

This vulnerability detector identifies JavaScript code that uses WebAssembly (WASM) hash functions with predictable or weak salt values. Using predictable salts in cryptographic hash operations makes the hashing vulnerable to rainbow table attacks and reduces the effectiveness of the security mechanism, potentially allowing attackers to reverse or predict hash values.

Detection Strategy

• Scans JavaScript source code for WebAssembly (WASM) hash function implementations

• Identifies hash operations that use predictable, hardcoded, or weak salt values

• Flags cases where salt generation lacks sufficient randomness or entropy

• Reports vulnerabilities when WASM hash functions use static strings, sequential numbers, or other deterministic salt patterns

Vulnerable code example

import { pbkdf2, bcrypt, scrypt, argon2id, createSHA256 } from "hash-wasm";

const PASSWORD_SALT = "app-static-salt-2024"; // Static salt - vulnerable

export async function hashPassword(password) {
  return pbkdf2({
    password,
    salt: PASSWORD_SALT, // Using static salt instead of random per-password...

✅ Secure code example

import { randomBytes } from "node:crypto";
import { pbkdf2, bcrypt, scrypt, argon2id, createSHA256 } from "hash-wasm";

export async function hashPassword(password) {
  const salt = crypto.getRandomValues(new Uint8Array(16)); // Generate random salt per password
  return pbkdf2({
    password,
    salt,...