Weak Cryptographic Hash: User-Controlled Salt

Functions that generate cryptographic hashes, which are passed a salt, should not be called with a tainted salt argument.

Weak Cryptographic Hash: User-Controlled Salt issues occur when:

1. Data enters a program through an untrusted source

2. User-controlled data is included within the salt, or used entirely as the salt within a cryptographic hashing function.

As with many software security vulnerabilities, Weak Cryptographic Hash: User-Controlled Salt is a means to an end, not an end in and of itself. At its root, the vulnerability is straightforward: an attacker passes malicious data to an application, and the data is then used as all or part of the salt in a cryptographic hash.

The problem with having a user-controlled salt is that it can enable various attacks:

1. The attacker may use this vulnerability to specify an empty salt for the data being hashed. From this, it would be trivial to quickly hash the data being hashed under his control using a number of different hashing algorithms to leak information about the hashing implementation used within your application. This could make "cracking" other data values easier by being able to limit the particular variant of hash used.
2. If the attacker is able to manipulate other users' salts, or trick other users into using an empty salt, this would enable them to compute "rainbow tables" for the application and more easily determine the hashed values.

Example 1: The following code uses a user-controlled salt for password hashing:

    ...
    salt = getenv("SALT");
    password = crypt(getpass("Password:"), salt);
    ...

Example 1 will run successfully, but anyone who can get to this functionality will be able to manipulate the salt used to hash the password by modifying the environment variable SALT. Additionally, this code uses the crypt() function, which should not be used for cryptographic hashing of passwords. After the program ships, it can be nontrivial to undo an issue regarding user-controlled salts, as it is extremely difficult to know if a malicious user determined the salt of a password hash.

Do not accept user-input for salt in methods that generate cryptographic hashes.

Weak Cryptographic Hash: User-Controlled Salt issues occur when:

1. Data enters a program through an untrusted source.

2. The user-controlled data is included within the salt, or used entirely as the salt in a cryptographic hash function.


As with many software security vulnerabilities, Weak Cryptographic Hash: User-Controlled Salt is a means to an end, not an end in and of itself. At its root, the vulnerability is straightforward: an attacker passes malicious data to an application, and the data is then used as all or part of the salt in a cryptographic hash function.

User-defined salt can enable various types of attacks:

1. Attackers can use this vulnerability to specify an empty salt for the hashed data. Then attackers can quickly hash the data under their control using many different hashing algorithms to leak the hashing implementation your application. This could make "cracking" other data values easier by limiting the particular variant of hash used.
2. If the attacker can manipulate other users' salts, or trick other users into using an empty salt, this enables them to compute "rainbow tables" for the application and easily determine the hashed values.

Example 1: The following code uses a user-controlled salt for password hashing:

func someHandler(w http.ResponseWriter, r *http.Request){
  r.parseForm()
  salt := r.FormValue("salt")
  password := r.FormValue("password")
  ...
  sha256.Sum256([]byte(salt + password))
}

The code in Example 1 will run successfully, but anyone who can get to this functionality can to manipulate the salt used to hash the password by modifying the environment variable salt. Additionally, this code uses the Sum256 cryptographic hash function, which should not be used for cryptographic hashing of passwords. After the program ships, it is nontrivial to undo an issue regarding user-controlled salts, as it is extremely difficult to know if a malicious user determined the salt of a password hash.

Methods that generate cryptographic hashes, which are passed a salt, should not be called with a tainted salt argument.

Weak Cryptographic Hash: User-Controlled Salt issues occur when:

1. Data enters a program through an untrusted source.

2. The user-controlled data is included within the salt, or used entirely as the salt within a cryptographic hash function.


As with many software security vulnerabilities, Weak Cryptographic Hash: User-Controlled Salt is a means to an end, not an end in and of itself. At its root, the vulnerability is straightforward: an attacker passes malicious data to an application, and the data is then used as all or part of the salt in a cryptographic hash function.

The problem with having a user-defined salt is that it can enable various attacks:

1. The attacker may use this vulnerability to specify an empty salt for the data being hashed. From this, it would be trivial to quickly hash the data being hashed under his control using a number of different hashing algorithms to leak information about the hashing implementation used within your application. This could make "cracking" other data values easier by being able to limit the particular variant of hash used.
2. If the attacker is able to manipulate other users' salts, or trick other users into using an empty salt, this would enable them to compute "rainbow tables" for the application and more easily determine the hashed values.

Example 1: The following code uses a user-controlled salt for password hashing:

import hashlib, binascii

def register(request):
  password = request.GET['password']
  username = request.GET['username']
  salt = os.environ['SALT']

  hash = hashlib.md5("%s:%s" % (salt, password,)).hexdigest()
  store(username, hash)
...

The code in Example 1 will run successfully, but anyone who can get to this functionality will be able to manipulate the salt used to hash the password by modifying the environment variable SALT. Additionally, this code uses the md5() cryptographic hash function, which should not be used for cryptographic hashing of passwords. After the program ships, it can be nontrivial to undo an issue regarding user-controlled salts, as it is extremely difficult to know if a malicious user determined the salt of a password hash.

Methods that generate cryptographic hashes, which are passed a salt, should not be called with a tainted salt argument.

Weak Cryptographic Hash: User-Controlled Salt issues occur when:

1. Data enters a program through an untrusted source

2. The user-controlled data is included within the salt, or used entirely as the salt within a cryptographic hashing function.

As with many software security vulnerabilities, Weak Cryptographic Hash: User-Controlled Salt is a means to an end, not an end in and of itself. At its root, the vulnerability is straightforward: an attacker passes malicious data to an application, this is then used as a salt in a cryptographic hash.

The problem with having a user-defined salt is that it can enable various attacks:

1. The attacker may use this vulnerability to specify an empty salt for the data being hashed. From this, it would be trivial to quickly hash the data being hashed under his control using a number of different hashing algorithms to leak information about the hashing implementation used within your application. This could make "cracking" other data values easier by being able to limit the particular variant of hash used.
2. If the attacker is able to manipulate other users' salts, or trick other users into using an empty salt, this would enable them to compute "rainbow tables" for the application and more easily determine the hashed values.

Example 1: The following code uses a user-controlled salt for password hashing:

    ...
    salt = req.params['salt']
    hash = @userPassword.crypt(salt)
    ...

The code in Example 1 will run successfully, but anyone who can get to this functionality will be able to manipulate the salt used to hash the password by modifying the parameter salt. Additionally, this code uses the String#crypt() function, which should not be used for cryptographic hashing of passwords. After the program ships, it can be nontrivial to undo an issue regarding user-controlled salts, as it is extremely difficult to know if a malicious user determined the salt of a password hash.