Skip to content

Use of Weak Cryptographic Algorithm

Description

A weak or broken cryptographic algorithm was identified. Using these functions will introduce vulnerabilities or downgrade the security of your application.

Examples

Insecure Code

javascript
const crypto = require('crypto'); const cipher = crypto.createCipher('des', 'secret');

Secure Code

javascript
const crypto = require('crypto'); const cipher = crypto.createCipheriv('aes-256-cbc', 'secret', Buffer.alloc(16));

Remediation

Replace the weak cryptographic algorithm with a secure one, such as AES.

Rule Details

FieldValue
IDCODE-0357
CategoryCrypto
SeverityMEDIUM
CWECWE-327
ConfidenceHIGH
ImpactHIGH
LikelihoodMEDIUM
ExploitabilityEASY
Tagscrypto, nodejs
OWASPA3:2017-Sensitive Data Exposure, A02:2021-Cryptographic Failures