Usage of weak hashing library on a password (SHA-1)

Description

Using a weak hashing library like SHA-1 for passwords increases the risk of data breaches. SHA-1 is vulnerable to collision attacks, where two different inputs can produce the same hash value, compromising data integrity and security.

Remediations

  • Do not use SHA-1 for hashing passwords. This algorithm is no longer considered secure and can make your system vulnerable to attacks.
    $encrypted_password = sha1($user->password); // unsafe
  • Do use stronger, more secure hashing functions like those provided by password_hash in PHP for storing passwords. This function is designed to use a strong hash algorithm that is currently considered secure.
    $encrypted_password = password_hash($user->password, PASSWORD_DEFAULT);

Associated CWE

OWASP Top 10

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=php_lang_weak_password_hash_sha1

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=php_lang_weak_password_hash_sha1