Description

Detects the use of cryptographically weak cipher algorithms in Ruby applications using OpenSSL. Using weak encryption algorithms can compromise data confidentiality since they may be vulnerable to cryptographic attacks, potentially allowing attackers to decrypt sensitive information.

Detection Strategy

• Check if the OpenSSL library is imported in the Ruby code

• Look for OpenSSL Cipher initialization calls using Cipher.new()

• Examine if the cipher algorithm specified as argument is in the list of known weak ciphers

• Report a vulnerability if a weak cipher algorithm (like DES) is used for encryption

Vulnerable code example

require 'openssl'

# DES is a legacy cipher that is cryptographically broken
cipher = OpenSSL::Cipher.new('DES')  

# Triple-DES (DES-EDE3) is also deprecated and vulnerable
cipher2 = OpenSSL::Cipher.new('DES-EDE3')

✅ Secure code example

require 'openssl'

# Use AES-256-GCM - AEAD cipher providing confidentiality and authenticity
cipher = OpenSSL::Cipher.new('AES-256-GCM')

# Alternative strong cipher - AES-256 in CBC mode with proper padding
cipher2 = OpenSSL::Cipher.new('AES-256-CBC')