Description

Detects hardcoded encryption keys in Kony JavaScript applications. Using hardcoded encryption keys is a critical security vulnerability as it can lead to compromised data encryption, making it easier for attackers to decrypt sensitive information. This significantly weakens the application's security posture and violates cryptographic best practices.

Detection Strategy

• Identifies calls to Kony encryption methods in JavaScript code

• Examines the second parameter of these encryption method calls

• Checks if the encryption key parameter is a hardcoded value instead of being retrieved from a secure configuration or key management system

• Reports a vulnerability when encryption methods are called with literal/hardcoded key values

Vulnerable code example

// Demonstration of hardcoded encryption key vulnerability
var secretKey = "MyHardcodedSecretKey123";  // Vulnerable: encryption key exposed in source code

// SINK: Using hardcoded key for encryption
var encrypted = kony.crypto.encrypt(
    "aes",
    secretKey,  // Vulnerable: hardcoded key used for encryption
    "sensitive_data"...

✅ Secure code example

// Generate a secure encryption key using crypto API
var secretKey = kony.crypto.newKey("aes", 256);  // Safe: key generated dynamically at runtime

// Store the key securely for later use if needed
kony.store.setItem("ENCRYPTION_KEY", secretKey);

// SECURE: Using dynamically generated key for encryption
var encrypted = kony.crypto.encrypt(...