generic.secrets.security.detected-bcrypt-hash.detected-bcrypt-hash

Community Favorite
profile photo of semgrepsemgrep
Author
37,965
Download Count*
LGPL Commons Clause
License

bcrypt hash detected

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: detected-bcrypt-hash
    pattern-regex: \$2[aby]?\$[\d]+\$[./A-Za-z0-9]{53}
    languages:
      - regex
    message: bcrypt hash detected
    severity: ERROR
    metadata:
      cwe:
        - "CWE-798: Use of Hard-coded Credentials"
      category: security
      technology:
        - secrets
        - bcrypt
      confidence: LOW
      owasp:
        - A07:2021 - Identification and Authentication Failures
      references:
        - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
      cwe2022-top25: true
      cwe2021-top25: true
      subcategory:
        - audit
      likelihood: LOW
      impact: HIGH
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      vulnerability_class:
        - Hard-coded Secrets

Examples

detected-bcrypt-hash.txt

--
-- Dumping data for table `users`
--

INSERT INTO `users` (`user_id`, `username`, `password`, `flag`) VALUES
# ruleid: detected-bcrypt-hash
(1, 'rogers63', '$2y$12$s.YfVZdfvAuO/Iz6fte5iO..ZbbEgreZnDcYOGvX4NGJskYQIstcG', 1),