Java


JAVA.CRYPTO.BASE64 : Unsafe Base64 Encoding (Java)

Summary

Base64 encoding is used. This encoding is relatively easy to decode and should not be used with sensitive data.

Properties

Class Name Unsafe Base64 Encoding (Java)
Significance security
Mnemonic JAVA.CRYPTO.BASE64
Categories
CWE CWE:327 Use of a Broken or Risky Cryptographic Algorithm
CERT-Java CERT-Java:DRD18 Do not use the default behavior in a cryptographic library if it does not use recommended practices
  CERT-Java:MSC02-J Generate strong random numbers
OWASP-2017 OWASP-2017:A2 Broken authentication
OWASP-2021 OWASP-2021:A7 Identification and authorization failures
Availability Available for Java only.
Enabling Checks for this warning class are disabled by default, and require pedantic Java analysis mode which is also disabled by default. To enable the checks, make the following changes to the project configuration file.
JAVA_ANALYSIS_PEDANTIC_MODE = Yes
WARNING_FILTER += allow class="Unsafe Base64 Encoding (Java)"

Example

import java.security.NoSuchAlgorithmException;
import java.security.NoSuchProviderException;

import javax.crypto.Cipher;
import javax.crypto.NoSuchPaddingException;

public class BrokenAlgorithms {

  public static void main(String[] args) throws NoSuchAlgorithmException, NoSuchPaddingException, NoSuchProviderException {
      Cipher.getInstance("DES");                   /* Warnings of two classes issued here:
                                                    * - Cryptographic Algorithm with Risky Default Cipher (Java)
                                                    * - Risky Cryptographic Algorithm (Java)
                                                    */
      Cipher.getInstance("MyComplexAlgo", "myProvider");
      Cipher.getInstance("MD5", "myProvider");     // Weak Hash Algorithm (Java) warning issued here

      String mypassword= "Hello World !";
      Base64.decodeBase64(mypassword.getBytes()); // Unsafe Base64 Encoding (Java) warning issued here

      Cipher.getInstance("AES/ECB/NoPadding");    // Cryptographic Algorithm with Weak Cipher (Java) warning issued here
      Cipher.getInstance("AES");                  // Cryptographic Algorithm with Risky Default Cipher (Java) warning issued here
  }
}

Resolution

Use a safer cryptography algorithm.

Relevant Configuration File Parameters

The following configuration file parameters affect checks for this warning class.