CWE-328: Use of Weak Hash

Description:
The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).

Extended Description:
A hash function is defined as an algorithm that maps arbitrarily sized data into a fixed-sized digest (output) such that the following properties hold: 
	    
	      The algorithm is not invertible (also called "one-way" or "not reversible") 
	      The algorithm is deterministic; the same input produces the same digest every time 
	    
	    
	     Building on this definition, a cryptographic hash function must also ensure that a malicious actor cannot leverage the hash function to have a reasonable chance of success at determining any of the following: 
	    
	      the original input (preimage attack), given only the digest 
	      another input that can produce the same digest (2nd preimage attack), given the original input 
	      a set of two or more inputs that evaluate to the same digest (birthday attack), given the actor can arbitrarily choose the inputs to be hashed and can do so a reasonable amount of times 
	    
	    What is regarded as "reasonable" varies by context and t

Affected languages: Not Language-Specific
Affected technologies: ICS/OT
Parent weaknesses: CWE-326, CWE-327

Consequences:
  - Access Control: Bypass Protection Mechanism

Detection methods:
  - Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without havin

Mitigations:
  - [Architecture and Design] Use an adaptive hash function that can be configured to change the amount of computational effort needed to compute the hash, such as the number of iterations ("stretching") or the amount of memory required. Some hash functions perform salting automatically. These functions can significantly increas

Demonstrative examples:
In both of these examples, a user is logged in if their given password matches a stored password:
This code relies exclusively on a password mechanism (CWE-309) using only one factor of authentication (CWE-308). If an attacker can steal or guess a user's password, they are given full access to their account. Note this code also uses SHA-1, which is a weak hash (CWE-328).  It also does not use a salt (CWE-759).
unsigned char *check_passwd(char *plaintext) { ctext = simple_digest("sha1",plaintext,strlen(plaintext), ... ); 
                         //Login if hash matches stored hash 
                         if (equal(ctext, secret_password())) { login_user(); } }
String plainText = new String(plainTextIn); MessageDigest encer = MessageDigest.getInstance("SHA"); encer.update(plainTextIn); by

In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.
At least one OT product used weak hashes.

Real-world examples:
  - CVE-2022-30320: Programmable Logic Controller (PLC) uses a protocol with a cryptographically insecure hashing algorithm for passwords.
  - CVE-2005-4900: SHA-1 algorithm is not collision-resistant.
  - CVE-2020-25685: DNS product uses a weak hash (CRC32 or SHA-1) of the query name, allowing attacker to forge responses by computing domain names with the same hash.
  - CVE-2012-6707: blogging product uses MD5-based algorithm for passwords.
  - CVE-2019-14855: forging of certificate signatures using SHA-1 collisions.