Description

This vulnerability detector identifies the use of broken hash functions such as MD2, MD4, MD5, SHA-1 and RIPEMD-160 over sensitive data in Rust applications, including their use as the inner digest of an HMAC. These digests are vulnerable to collision and preimage attacks and are fast enough to brute force, so hashing passwords, keys or tokens with them lets an attacker recover the original value or forge a colliding one.

Detection Strategy

• Scans Rust source files that import a weak digest crate ('md2', 'md4', 'md5', 'sha1', 'ripemd') or the 'hmac' crate

• Reports HMAC constructions whose inner digest is a broken hash, such as Hmac::<Md5>::new_from_slice(...), regardless of the data being authenticated, because the construction itself is disallowed

• Reports one-shot digest calls on a weak hash type, such as Sha1::digest(...), when the hashed value looks sensitive, for example a password, key, token or credential

• Reports incremental hashing when update(...) is called on a hasher whose creation traces back to a weak hash type and the value being hashed looks sensitive

• Looks through byte conversions such as as_ref() and as_bytes() to reach the value that is actually hashed

• Does not report weak hashing of non-sensitive data, such as a file checksum or a deduplication key

Vulnerable code example

use hmac::{Hmac, KeyInit, Mac};
use md5::{Digest, Md5};
use sha1::Sha1;

fn hash_password(password: &[u8]) -> Vec<u8> {
    let mut hasher = Md5::new();
    // VULNERABLE: MD5 is collision-prone and far too fast to protect a password
    hasher.update(password);...

✅ Secure code example

use hmac::{Hmac, KeyInit, Mac};
use sha2::{Digest, Sha256};

fn hash_password(password: &[u8]) -> Vec<u8> {
    let mut hasher = Sha256::new();
    // SECURE: SHA-256 is not a broken digest; use a KDF such as Argon2 to store passwords
    hasher.update(password);
    hasher.finalize().to_vec()...