We are using 'crypto.js' in our application.
Since 'crypto.js' uses open SSL ,are we vulnerable to heartbleeding attack?
If yes, what can we do to prevent it?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
Crypto.js does not use OpenSSL, it is interoperable with some of the same algorithms, and is not vulnerable to Heartbleed. All the more so because usually you use crypto.js on the client, not on the OpenSSLified server.
If you browse the Crypto.js source, it does not implement TLS (or SSL), and as such can't implement the TLS extension Heartbeats. By not implementing TLS or Heartbeats, it can't have the Heartbeat vulnerability exploited by Heartbleed (trusting the payload length in a HB request even if its longer than the original message and echoing back that much data).
Yes, there are a couple references to OpenSSL in cryptoJS (all within cipher-core.js, but those are merely in response to either using an OpenSSL key format (e.g., its in code defined within cryptoJS with
CryptoJS.format.OpenSSL) or using an OpenSSL key-derivation-function (
OpenSSLKdf = C_kdf.OpenSSL). Note, cryptojs does not link to the OpenSSL library or call the OpenSSL executable.