mcp-server-semgrep/semgrep-rules/java/lang/security/audit/crypto/use-of-default-aes.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
  - id: use-of-default-aes
    pattern-either:
      - patterns:
          - pattern-either:
              - pattern-inside: |
                  import javax;
                  ...
          - pattern-either:
              - pattern: javax.crypto.Cipher.getInstance("AES")
              - pattern: (javax.crypto.Cipher $CIPHER).getInstance("AES")
      - patterns:
          - pattern-either:
              - pattern-inside: |
                  import javax.*;
                  ...
              - pattern-inside: |
                  import javax.crypto;
                  ...
          - pattern-either:
              - pattern: crypto.Cipher.getInstance("AES")
              - pattern: (crypto.Cipher $CIPHER).getInstance("AES")
      - patterns:
          - pattern-either:
              - pattern-inside: |
                  import javax.crypto.*;
                  ...
              - pattern-inside: |
                  import javax.crypto.Cipher;
                  ...
          - pattern-either:
              - pattern: Cipher.getInstance("AES")
              - pattern: (Cipher $CIPHER).getInstance("AES")
    metadata:
      functional-categories:
        - 'crypto::search::mode::javax.crypto'
      cwe:
        - "CWE-327: Use of a Broken or Risky Cryptographic Algorithm"
      owasp:
        - A03:2017 - Sensitive Data Exposure
        - A02:2021 - Cryptographic Failures
      category: security
      technology:
        - java
      references:
        - https://owasp.org/Top10/A02_2021-Cryptographic_Failures
        - https://googleprojectzero.blogspot.com/2022/10/rc4-is-still-considered-harmful.html
      subcategory:
        - vuln
      likelihood: MEDIUM
      impact: MEDIUM
      confidence: HIGH
    message: >-
      Use of AES with no settings detected. By default, java.crypto.Cipher uses ECB mode. ECB doesn't 
      provide message confidentiality and is not semantically secure so should not be used.
      Instead, use a strong, secure cipher: java.crypto.Cipher.getInstance("AES/CBC/PKCS7PADDING").
      See https://owasp.org/www-community/Using_the_Java_Cryptographic_Extensions
      for more information.
    severity: WARNING
    languages:
      - java