SV.AUTH.HASH.MIGHT

Use of weak cryptographic algorithm

The SV.AUTH.HASH checkers detect whenever the MD5 hashing technique is used with the username/password fetched from the servlet's request. If username is used, then Klocwork reports an SV.AUTH.HASH.MIGHT defect. If password is used to generate MD5, then Klocwork reports an SV.AUTH.HASH.MUST defect.

As of release 2023.2, this checker supports Jakarta EE.

Vulnerability and risk

The use of a weak cryptographic algorithm weakness can lead to the exposure of resources or functionality to unintended actors, possibly providing attackers with sensitive information or even the ability to execute arbitrary code.

Vulnerable code example 1

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
  public void doGet(HttpServletRequest request, HttpServletResponse response) 
    throws ServletException, IOException {
     String userName = request.getParameter("userName"); //Source
     String md5 = getMd5(userName);
     ...
  }
  public static String getMd5(String str)
     {
         try {
             MessageDigest md = MessageDigest.getInstance("MD5"); //SV.WEAK.CRYPT
             byte[] messageDigest = md.digest(str.getBytes());   //SV.AUTH.HASH.MIGHT - Sink
             //...
     }

In this example, Klocwork reports an SV.AUTH.HASH.MIGHT on line 11, indicating, "Use of risky MD5 hash with username can lead to authentication bypass.".

Fixed code example 1

Copy

1
2
3
4
5
6
7
8
9
10
11
12
  public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
       String userName = request.getParameter("userName");
       String md5 = getMd5(userName);
       ...
  }
  public static String getMd5(String str)
  {
   try {
       MessageDigest md = MessageDigest.getInstance("SHA3-256");
      byte[] messageDigest = md.digest(str.getBytes());
      //...
  }

In the fixed example, Klocwork no longer reports a defect because a safer hashing technique is used.

Related checkers

External guidance

Security training

Application security training materials provided by Secure Code Warrior.

Improper Authentication Training Video - Test your skills with a training example