What is Use of a One-Way Hash without a Salt (CWE-759)?

TL;DR: Use of a One-Way Hash without a Salt (CWE-759) is when passwords are hashed using one-way functions without unique salts, making them vulnerable to precomputed rainbow table attacks. Fix it by implementing strong random salt generation and adaptive hash functions.

What is Use of a One-Way Hash without a Salt?

Use of a One-Way Hash without a Salt (CWE-759) is a type of cryptographic vulnerability that occurs when a system uses one-way hash functions to store passwords or sensitive data but fails to include unique salt values. As defined by the MITRE Corporation under CWE-759, and classified by the OWASP Foundation under A04:2025 - Cryptographic Failures.

Quick Summary

Use of a One-Way Hash without a Salt is when a system hashes passwords or sensitive data using one-way hash functions but does not use unique salt values. This vulnerability weakens password security, making it easier for attackers to crack multiple users’ passwords simultaneously using precomputed rainbow tables. Jump to: What is Use of a One-Way Hash without a Salt? · Quick Summary · Overview · How It Works · Business Impact · Attack Scenario · Detection · Fix · Framework-Specific Fixes · Ask AI · Best Practices Checklist · FAQ · Vulnerabilities Related

Jump to: Quick Summary · Use of a One-Way Hash without a Salt Overview · How Use of a One-Way Hash without a Salt Works · Business Impact of Use of a One-Way Hash without a Salt · Use of a One-Way Hash without a Salt Attack Scenario · How to Detect Use of a One-Way Hash without a Salt · How to Fix Use of a One-Way Hash without a Salt · Framework-Specific Fixes for Use of a One-Way Hash without a Salt · How to Ask AI to Check Your Code for Use of a One-Way Hash without a Salt · Use of a One-Way Hash without a Salt Best Practices Checklist · Use of a One-Way Hash without a Salt FAQ · Vulnerabilities Related to Use of a One-Way Hash without a Salt · References · Scan Your Own Site

Use of a One-Way Hash without a Salt Overview

What

Use of a One-Way Hash without a Salt occurs when sensitive data, such as passwords, is hashed using one-way functions but lacks unique salt values.

Why it matters

Without salts, attackers can easily crack multiple users’ passwords simultaneously by leveraging precomputed rainbow tables. This significantly weakens the security of password storage and authentication systems.

Where it occurs

This vulnerability commonly affects applications that store user credentials without implementing proper salting mechanisms.

Who is affected

Users whose passwords are stored in a system with this vulnerability are at risk of having their passwords compromised.

Who is NOT affected

Systems already using adaptive hash functions like bcrypt or scrypt, which automatically handle salting.

How Use of a One-Way Hash without a Salt Works

Root Cause

The root cause lies in the lack of unique salt values for each password when hashing. This allows attackers to use precomputed rainbow tables to crack multiple passwords simultaneously.

Attack Flow

1. An attacker gains access to the hash database containing unsalted hashes.
2. The attacker uses rainbow tables or brute force attacks to find matching hashes.
3. Once a match is found, the attacker can obtain plaintext passwords for all users with identical hashes.
4. The attacker exploits compromised credentials to gain unauthorized access.

   Prerequisites to Exploit

   • Access to the hash database containing unsalted hashes.
   • Knowledge of common hashing algorithms used by the system.
   • Computational resources to perform brute force or rainbow table attacks.

     Vulnerable Code

     ```python import hashlib

def hash_password(password): return hashlib.md5(password.encode()).hexdigest()

This code demonstrates a simple MD5 hashing function without any salt.

### Secure Code
```python
import bcrypt

def hash_password(password):
    salt = bcrypt.gensalt()
    hashed_password = bcrypt.hashpw(password.encode(), salt)
    return hashed_password.decode('utf-8')

The secure version uses the bcrypt library to generate a unique salt and hash the password.

Business Impact of Use of a One-Way Hash without a Salt

Confidentiality

• Attackers can obtain plaintext passwords for all users with identical hashes.

  Integrity

• Compromised credentials allow attackers to modify user data or perform unauthorized actions.

  Availability

• If critical accounts are compromised, the system may be rendered unavailable due to unauthorized access.

Use of a One-Way Hash without a Salt Attack Scenario

1. An attacker gains access to an application’s password database containing unsalted MD5 hashes.
2. The attacker uses rainbow tables to find matching hash values for common passwords.
3. Once matches are found, the attacker can obtain plaintext passwords for all users with identical hashes.
4. The attacker exploits compromised credentials to gain unauthorized access and modify user data.

How to Detect Use of a One-Way Hash without a Salt

Manual Testing

• Review authentication code for instances where password hashes are generated using one-way functions without unique salts.
• Check if the system uses adaptive hash functions like bcrypt or scrypt that handle salting automatically.
• Verify that each password is hashed with a unique salt value.

Automated Scanners (SAST/DAST)

Static analysis can detect instances where passwords are hashed without unique salts. Dynamic testing can confirm whether these hashes can be cracked using rainbow tables.

PenScan Detection

PenScan’s scanner engines such as ZAP, Nuclei, and Wapiti can identify unsalted hash functions in the codebase.

False Positive Guidance

A false positive may occur if a salt is present but not unique for each password. Ensure that salts are generated uniquely per user to avoid this issue.

How to Fix Use of a One-Way Hash without a Salt

• Implement a strong random salt generator for each password.
• Use adaptive hash functions like bcrypt or scrypt that handle salting automatically.
• Store the salt along with the hashed password in the database.
• Regularly update and rehash passwords using stronger algorithms.

Framework-Specific Fixes for Use of a One-Way Hash without a Salt

Python/Django

import bcrypt

def hash_password(password):
    salt = bcrypt.gensalt()
    hashed_password = bcrypt.hashpw(password.encode(), salt)
    return hashed_password.decode('utf-8')

How to Ask AI to Check Your Code for Use of a One-Way Hash without a Salt

Use of a One-Way Hash without a Salt Best Practices Checklist

✅ Implement a strong random salt generator for each password. ✅ Use adaptive hash functions like bcrypt or scrypt that handle salting automatically. ✅ Store the salt along with the hashed password in the database. ✅ Regularly update and rehash passwords using stronger algorithms. ✅ Verify that salts are unique per user.

Use of a One-Way Hash without a Salt FAQ

How does the Use of a One-Way Hash without a Salt vulnerability work?

The system hashes passwords using a one-way hash function but fails to add a unique salt, making it vulnerable to rainbow table attacks and brute force attempts.

Why is adding a salt important in hashing passwords?

Adding a unique salt for each password ensures that identical passwords produce different hash outputs, preventing attackers from precomputing hashes using rainbow tables.

What are the consequences of not salting hashed passwords?

Attackers can easily crack multiple users’ passwords simultaneously if they use the same hashing algorithm without salts.

How do I detect Use of a One-Way Hash without a Salt in my codebase?

Review your authentication system for instances where password hashes are generated without unique salt values.

What is an adaptive hash function and why should it be used?

An adaptive hash function, such as bcrypt or scrypt, introduces computational overhead that makes brute force attacks more difficult and resource-intensive.

How can I fix Use of a One-Way Hash without a Salt in my application?

Implement a strong random salt generator for each password and use it along with the password when hashing.

What are some best practices to prevent this vulnerability?

Always use industry-approved techniques like bcrypt, scrypt, or PBKDF2 that automatically handle salting.

Vulnerabilities Related to Use of a One-Way Hash without a Salt

| CWE | Name | Relationship | |—|—|—| | CWE-916 | Use of Password Hash With Insufficient Computational Effort (ChildOf) |

References

• MITRE - CWE-759
• OWASP Top 10 A04:2025 - Cryptographic Failures
• NVD NIST

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Use of a One-Way Hash without a Salt and other risks before an attacker does.