Description

Detects the use of CBC cipher mode in SSH2 SFTP client configurations which can be vulnerable to padding oracle attacks. CBC mode without proper authentication can allow attackers to decrypt encrypted data by manipulating ciphertext blocks and observing system responses.

Detection Strategy

• Check if the source code imports or uses the 'ssh2-sftp-client' module/package

• Look for SFTP client configuration options or connection settings

• Identify if CBC cipher mode is specified in the encryption settings

• Report a vulnerability if CBC cipher mode is detected in SFTP client configurations

Vulnerable code example

import SftpClient from 'ssh2-sftp-client';

async function connectWithInsecureCipher() {
  const client = new SftpClient();
  
  const config = {
    host: 'sftp.example.com',
    username: 'user',...

✅ Secure code example

import SftpClient from 'ssh2-sftp-client';

async function connectWithSecureCipher() {
  const client = new SftpClient();
  
  const config = {
    host: 'sftp.example.com',
    username: 'user',...