mcp-server-semgrep/semgrep-rules/java/lang/security/audit/crypto/use-of-aes-ecb.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: use-of-aes-ecb
  pattern: $CIPHER.getInstance("=~/AES/ECB.*/") 
  metadata:
    functional-categories:
      - 'crypto::search::mode::javax.crypto'
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    category: security
    technology:
    - java
    references:
    - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
    - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: HIGH
  message: >-
    Use of AES with ECB mode detected. ECB doesn't provide message confidentiality and 
    is not semantically secure so should not be used.
    Instead, use a strong, secure cipher: Cipher.getInstance("AES/CBC/PKCS7PADDING").
    See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions
    for more information.
  severity: WARNING
  languages:
  - java