CryptoPyt: Unraveling Python Cryptographic APIs Misuse with Precise Static Taint Analysis

Cryptographic APIs are essential for ensuring the security of software systems. However, many research studies have revealed that the misuse of cryptographic APIs is commonly widespread. Detecting such misuse in Python poses challenges due to its intricate features, including dynamic features and pass-by-object-reference. Existing tools lack the precision and accuracy to tackle these challenges, leading to both high false positives and false negatives. In this work, we propose a specific Python Cryptographic Abstract Syntax Tree (PCAST) to represent the structure of source code, which rewrites AST nodes to handle complex Python features. Based on PCAST, we design and implement CryptoPyt, a static code analysis tool that leverages precise taint analysis and 17 cryptographic misuse rules to automatically identify potential cryptographic APIs misuse in Python projects. We conduct an in-depth analysis of all the APIs within the popular 21 Python cryptographic libraries and design five kinds of taint detectors to perform intra-procedural and inter-function analysis on the APIs and arguments. To demonstrate the effectiveness of CryptoPyt, we conduct experiments with six state-of-the-art tools (i.e., Cryptolation, LICMA, Bandit, Dlint, Semgrep and CodeQL) on both the labeled benchmark PyCryptoBench and the real-world Python cryptographic projects datasets PCAMD. Our evaluations show that CryptoPyt achieves an F1 score of 0.80 on PyCryptoBench and a recall rate of 99.08% on PCAMD. Furthermore, we disclose the discovered critical issues to the developers and seven high-level CVE IDs have been assigned to these findings. Our tool contributes to enhancing the security of Python cryptographic software.