Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

When a non-cryptographic PRNG is used in a security context (such as generating session tokens or cryptographic keys), an attacker may be able to predict its output and compromise the security mechanism.

Prévalence

Élevée

Fréquemment exploitée

Impact

Élevé

2 règles de sévérité élevée

Prévention

Documentée

4 exemples de correctifs

2 Prévention

Comment corriger cette vulnérabilité

Stratégies de prévention pour Weak PRNG basées sur 4 règles de détection Shoulder.

🐹 Go Tout voir Go détails →

Weak Random Number Generation for Security HIGH

Use crypto/rand instead of math/rand for security-sensitive values

+8 -6 go

- import "math/rand"
- 
- func generateToken() string {
-     token := make([]byte, 32)
-     rand.Read(token)
-     return hex.EncodeToString(token)
+ import "crypto/rand"
+ 
+ func generateToken() (string, error) {
+     token := make([]byte, 32)
+     if _, err := rand.Read(token); err != nil {
+         return "", err
+     }
+     return hex.EncodeToString(token), nil
  }

🟨 JavaScript Tout voir JavaScript détails →

Weak Random Number Generation in Security Context HIGH

Use crypto.randomBytes() or crypto.randomUUID() for security-sensitive random values

+2 -1 javascript

- const token = Math.random().toString(36).substring(2);
+ const crypto = require('crypto');
+ const token = crypto.randomBytes(32).toString('hex');

🐍 Python Tout voir Python détails →

Insecure Random Number Generation MEDIUM

Use the secrets module for tokens, passwords, and all security-sensitive randomness

+4 -5 python

- import random
- 
- def generate_token():
-     token = random.randint(100000, 999999)
-     return str(token)
+ import secrets
+ 
+ def generate_token():
+     return secrets.token_urlsafe(32)

Cryptographically Weak Random Number Generation MEDIUM

Use the secrets module instead of random for security-sensitive operations

+4 -5 python

- import random
- 
- def generate_token():
-     chars = 'abcdef0123456789'
-     return ''.join(random.choice(chars) for _ in range(32))
+ import secrets
+ 
+ def generate_token():
+     return secrets.token_hex(32)

Pratiques clés

Use of Math

3 Détection

Trouvez les vulnérabilités dans votre code

Utilisez Shoulder pour scanner votre code à la recherche de patterns Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). 4 règles.

terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=338

# Or scan entire project
npx @shoulderdev/cli trust .

Règles de Détection (4)

🐍 Python 2 rules

Insecure Random Number Generation MEDIUM

Detects use of insecure random number generators (random module) for security-critical operations. Use secrets module or os.urandom() for cryptographic randomness (tokens, passwords, keys, nonces).

Cryptographically Weak Random Number Generation MEDIUM

Detects use of the random module for security-sensitive operations like tokens, passwords, or cryptographic keys. The random module is not cryptographically secure. Use the secrets module instead.

🐹 Go 1 rules

Weak Random Number Generation for Security HIGH

Uses math/rand for security tokens, keys, or session IDs instead of crypto/rand.

🟨 Javascript 1 rules

Weak Random Number Generation in Security Context HIGH

Detects use of Math.random() for security-sensitive operations like generating tokens, session IDs, or cryptographic keys. Math.random() is not cryptographically secure and can be predicted by attackers.

🔷 Typescript 1 rules

Weak Random Number Generation in Security Context HIGH

4 Signes d'Alerte

Ce qu'il faut surveiller lors des revues de code

Ces patterns indiquent des vulnérabilités potentielles Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). Recherchez-les lors des revues de code et des audits de sécurité.

🟠

math/rand used for security-sensitive random values go-weak-random-number-generation

🟠

Math.random() used for security-sensitive operation: ... javascript-weak-random

🟠

use of Math javascript-weak-random

🟡

use of insecure random number generators (random module) for security-critical operations python-insecure-randomness

🟡

use of the random module for security-sensitive operations like tokens, passwords, or cryptographic python-weak-random

🔍

Scannez votre base de code pour Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Shoulder CLI trouve les motifs vulnérables dans toute votre base de code.

npx shoulder trust Parcourir toutes les règles