Skip to main content

Insecure encryption algorithm - MD5

Description

The web application uses insecure algorithms such as MD5 to hash passwords.

Impact

Crack captured credential easly.

Recommendation

Use secure hashing algorithms to store passwords like PBKDF2.

Threat

Authenticated attacker from the Internet with compromised DB hashes.

Expected Remediation Time

⌚ 30 minutes.

Score

Default score using CVSS 3.1. It may change depending on the context of the vulnerability.

Base

  • Attack vector: N
  • Attack complexity: H
  • Privileges required: L
  • User interaction: N
  • Scope: U
  • Confidentiality: L
  • Integrity: N
  • Availability: N

Temporal

  • Exploit code madurity: P
  • Remediation level: X
  • Report confidence: X

Result

  • Vector string: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:X
  • Score:
    • Base: 3.1
    • Temporal: 3.0
  • Severity:
    • Base: Low
    • Temporal: Low

Code Examples

Compliant code

The server uses a secure cipher algorithm

http {
server {
index: "index.html";
listen: "localhost:4446 ssl";
server_name: "localhost";
ssl_prefer_server_ciphers: "on";
ssl_ciphers: "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256"";
ssl_certificate: "cert.crt";
ssl_certificate_key: "cert.key";
ssl_protocols: "SSLv3 TLSv1.2";
}
}

Non compliant code

The server uses the insecure MD5 cipher algorithm

http {
server {
index: "index.html";
listen: "localhost:4446 ssl";
server_name: "localhost";
ssl_prefer_server_ciphers: "on";
ssl_ciphers: "RSA_WITH_RC4_128_MD5";
ssl_certificate: "cert.crt";
ssl_certificate_key: "cert.key";
ssl_protocols: "SSLv3 TLSv1 TLSv1.1";
}
}

Requirements