1588
access to their account. Note this code also uses SHA-1, which is a weak hash (CWE-328). It also
does not use a salt (CWE-759).
Example 2:
In this example, a new user provides a new username and password to create an account. The
program hashes the new user's password then stores it in a database.
Example Language: Python (Bad)
def storePassword(userName,Password):
hasher = hashlib.new('md5')
hasher.update(Password)
hashedPassword = hasher.digest()
# UpdateUserLogin returns True on success, False otherwise
return updateUserLogin(userName,hashedPassword)
While it is good to avoid storing a cleartext password, the program does not provide a salt to the
hashing function, thus increasing the chances of an attacker being able to reverse the hash and
discover the original password if the database is compromised.
Fixing this is as simple as providing a salt to the hashing function on initialization:
Example Language: Python (Good)
def storePassword(userName,Password):
hasher = hashlib.new('md5',b'SaltGoesHere')
hasher.update(Password)
hashedPassword = hasher.digest()
# UpdateUserLogin returns True on success, False otherwise
return updateUserLogin(userName,hashedPassword)
Note that regardless of the usage of a salt, the md5 hash is no longer considered secure, so this
example still exhibits CWE-327.
Observed Examples
Reference Description
CVE-2008-1526 Router does not use a salt with a hash, making it easier to crack passwords.
https://www.cve.org/CVERecord?id=CVE-2008-1526
CVE-2006-1058 Router does not use a salt with a hash, making it easier to crack passwords.
https://www.cve.org/CVERecord?id=CVE-2006-1058
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 816 OWASP Top Ten 2010 Category A7 - Insecure
Cryptographic Storage
809 2359
MemberOf 866 2011 Top 25 - Porous Defenses 900 2372
MemberOf 958 SFP Secondary Cluster: Broken Cryptography 888 2398
MemberOf 1346 OWASP Top Ten 2021 Category A02:2021 -
Cryptographic Failures
1344 2488
MemberOf 1402 Comprehensive Categorization: Encryption 1400 2527
References
[REF-291]Johnny Shelley. "bcrypt". < http://bcrypt.sourceforge.net/ >.
[REF-292]Colin Percival. "Tarsnap - The scrypt key derivation function and encryption utility". <
http://www.tarsnap.com/scrypt.html >.
CWE Version 4.14
CWE-760: Use of a One-Way Hash with a Predictable Salt
CWE-760: Use of a One-Way Hash with a Predictable Salt