Usage of weak encryption algorithm on a password (RC4)

Description

Using RC4 for encrypting passwords is insecure. RC4 is a weak encryption algorithm that can be easily compromised, leading to potential security risks. Furthermore, using any form of encryption for passwords is not advisable because encryption is designed to be reversible. This means that given enough resources, an attacker could decrypt the passwords and access them in plain text. For securing passwords, hashing is the recommended approach because it is a one-way process that does not allow for the original password to be retrieved.

Remediations

  • Do not use RC4 or any encryption algorithm for password storage. Encryption algorithms are not secure enough for password protection and can be reversed to expose plain text passwords.
  • Do use a secure hashing algorithm specifically designed for password storage, such as Argon2id. Hashing is a one-way process, making it significantly more secure for storing passwords.
const argon2 = require("argon2");
const hash = await argon2.hash(req.params.password, { type: argon2.argon2id })

References

Associated CWE

OWASP Top 10

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=javascript_lang_weak_password_encryption_rc4

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=javascript_lang_weak_password_encryption_rc4