CWE-326 | Hawk.js Contains Weak Hash Algorithm

[alivianmuir]

Summary

The hawk.js accepts SHA-1 credentials for authentication which is no longer considered cryptographically secure. With enough resources, an attacker might be able to crack the authentication mechanism and disclose sensitive information from the application.

Simplest Example to Reproduce

if (['sha1', 'sha256'].indexOf(credentials.algorithm) === -1) {
    return ''
}

Possible Solution

if (credentials.algorithm !== 'sha256') {
    return ''
}

Context

This issue has been created as part of our SCA vulnerability remediation efforts.

Your Environment

The Cypress package is used for UAT automation in our Gitlab pipelines.

@cypress/request : 3.0.5

[alivianmuir]

@jennifer-shehane Thank you for reviewing this issue. Is this a fix that will be considered for patch release?

[ehallq]

Not sure who to ping @benpatterson @brian-mann @colebrumley @emilyrohrbough @estrada9166 @jennifer-shehane @tgriesser

Anything blocking for this change to be implemented? This is marked as a vulnerability in our system (Sonatype scan)