Description

This detector identifies insecure usage of CryptoJS encryption in TypeScript code where passphrase-based encryption modes are used improperly. CryptoJS passphrase mode can be vulnerable due to weak key derivation or improper configuration, potentially allowing attackers to decrypt sensitive data.

Detection Strategy

• Scans TypeScript source code for CryptoJS library usage patterns

• Identifies function calls or method invocations related to CryptoJS encryption operations

• Detects when passphrase-based encryption modes are configured in an insecure manner

• Triggers when vulnerable CryptoJS encryption patterns are found in the parsed code syntax tree

• Reports vulnerabilities when insecure passphrase mode configurations are detected that could compromise data encryption

Vulnerable code example

import CryptoJS from "crypto-js";

function encryptPassword(password: string): string {
    const encrypted = CryptoJS.AES.encrypt(password, "myPassword123"); // Weak: string passphrase uses MD5-based key derivation
    return encrypted.toString();
}

function encryptWithStoredKey(data: string): string {...

✅ Secure code example

import CryptoJS from "crypto-js";

function encryptPassword(password: string): string {
    const salt = CryptoJS.lib.WordArray.random(16);
    const key = CryptoJS.PBKDF2(password, salt, {
        keySize: 256 / 32,
        iterations: 150000
    }); // Strong PBKDF2 key derivation replaces weak string passphrase...