Description

This vulnerability detects the use of legacy RSA padding schemes in JavaScript code. Legacy padding schemes like PKCS#1 v1.5 are vulnerable to padding oracle attacks and should be replaced with more secure schemes like OAEP (Optimal Asymmetric Encryption Padding).

Detection Strategy

• Scans JavaScript source code for RSA encryption or decryption operations

• Identifies code that uses insecure or legacy RSA padding schemes

• Flags RSA implementations that don't specify secure padding options or explicitly use vulnerable padding methods

• Reports vulnerabilities when RSA operations use deprecated padding schemes that are susceptible to cryptographic attacks

Vulnerable code example

const crypto = require("crypto");

function encryptData(data, publicKey) {
  // VULNERABLE: RSA_PKCS1_PADDING is susceptible to padding oracle attacks
  return crypto.publicEncrypt(
    { key: publicKey, padding: crypto.constants.RSA_PKCS1_PADDING },
    data
  );...

✅ Secure code example

const crypto = require("crypto");

function encryptData(data, publicKey) {
  // SAFE: RSA_PKCS1_OAEP_PADDING prevents padding oracle attacks
  return crypto.publicEncrypt(
    { key: publicKey, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING },
    data
  );...