Cryptographic API Misuse Vulnerability

[lialon]

Description:

In the "django-mirage-field/mirage/crypto.py", I have identified security vulnerabilities about insecure cryptographic algorithm. ECB mode encryption is not semantically secure, which means it might cause information leakage.

Location:

https://github.com/luojilab/django-mirage-field/blob/master/mirage/crypto.py#L31

 encryptor = Cipher(algorithms.AES(self.key),
                           modes.ECB(), default_backend()).encryptor()

https://github.com/luojilab/django-mirage-field/blob/master/mirage/crypto.py#L39

 decryptor = Cipher(algorithms.AES(self.key),
                           modes.ECB(), default_backend()).decryptor()

Reference

• CWE-327: Use of a Broken or Risky Cryptographic Algorithm

Recommendate

Use other cipher mode such as CFB or CTR with random IV.