[HIGH] [CWE-327] ECB mode detected — use CBC, CTR, or GCM mode instead

[iamngoni]

Heimdall Finding

• Severity: high
• Confidence: high
• Fingerprint: 6f239a070e45f9dfb2ddbda5a2db845db77489f404cc18ade6c70f1b4c504302
• Location: dhra/lib/core/utils/encryption.dart:21-21
• CWE: CWE-327

Summary

ECB mode detected — use CBC, CTR, or GCM mode instead

Evidence

final Key key = Key.fromUtf8(ApiConfig.encryptionKey);
    final IV iv = IV.fromLength(16);
    final Encrypter encrypter = Encrypter(AES(key, mode: AESMode.ecb));
    final String decrypted =
        encrypter.decrypt(Encrypted.fromBase64(encrypted), iv: iv);

Suggested Patch

```diff
--- dhra/lib/core/utils/encryption.dart
+++ dhra/lib/core/utils/encryption.dart
@@ -20,7 +20,7 @@
     final IV iv = IV.fromLength(16);
-    final Encrypter encrypter = Encrypter(AES(key, mode: AESMode.ecb));
+    final Encrypter encrypter = Encrypter(AES(key, mode: AESMode.cbc));
     final String decrypted =
         encrypter.decrypt(Encrypted.fromBase64(encrypted), iv: iv);
     logger.d(json.decode(decrypted));