TypeScript : Null encryption key
Classification
OWASP Top 10 2013 A6-Sensitive Data Exposure OWASP Top 10 2017 A3-Sensitive Data Exposure OWASP Top 10 2021 A2-Cryptographic Failures A4-Insecure Design OWASP MASVS V3: 3.3.(L1/L2/L1+R/L2+R) V8: 8.13.(L1+R/L2+R) OWASP ASVS Stored Cryptography PCI DSS 4.0 3.6.1 6.2.4 8.3.2 HIPAA §164.312 (e)(1) CWE CWE-321Overview
The encryption key with a value of null can result in an application compromise.
You should never use a null encryption key, since it significantly reduces the protection afforded by a good encryption algorithm, but also makes fixing the problem difficult. Information that it uses a null key encryption is accessible to at least every developer of the application. After the application is installed, the null encryption key can not be removed without updating the software. If an account that is protected by a NULL encryption key is compromised, system administrators will be forced either to neglect the safety, or to restrict the access to the application. Constant strings are easily extracted from the compiled application by decompilers. Therefore, it is not necessary for an attacker to have access to the source code, to determine that a null encryption key is used.
Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.
References
