CWE-759Use of a One-Way Hash without a Salt

Description

Common consequences· 1

• Access Control — Bypass Protection Mechanism, Gain Privileges or Assume Identity
  If an attacker can gain access to the hashes, then the lack of a salt makes it easier to conduct brute force attacks using techniques such as rainbow tables.

Potential mitigations· 3

• [Architecture and Design]
• [Architecture and Design]If a technique that requires extra computational effort can not be implemented, then for each password that is processed, generate a new random salt using a strong random number generator with unpredictable seeds. Add the salt to the plaintext password before hashing it. When storing the hash, also store the salt. Do not use the same salt for every password.
• [Implementation, Architecture and Design]When using industry-approved techniques, use them correctly. Don't cut corners by skipping resource-intensive steps (CWE-325). These steps are often essential for preventing common attacks.

(incoming)1

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.