Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

When a non-cryptographic PRNG is used in a security context (such as generating session tokens or cryptographic keys), an attacker may be able to predict its output and compromise the security mechanism.

보급률

높음

자주 악용됨

영향

높음

2개의 높은 심각도 규칙

예방

문서화됨

4개의 수정 예시

2 예방

이 취약점을 수정하는 방법

4개의 Shoulder 탐지 규칙을 기반으로 한 Weak PRNG 예방 전략.

🐹 Go 모두 보기 Go 자세히 →

Weak Random Number Generation for Security HIGH

Use crypto/rand instead of math/rand for security-sensitive values

+8 -6 go

- import "math/rand"
- 
- func generateToken() string {
-     token := make([]byte, 32)
-     rand.Read(token)
-     return hex.EncodeToString(token)
+ import "crypto/rand"
+ 
+ func generateToken() (string, error) {
+     token := make([]byte, 32)
+     if _, err := rand.Read(token); err != nil {
+         return "", err
+     }
+     return hex.EncodeToString(token), nil
  }

🟨 JavaScript 모두 보기 JavaScript 자세히 →

Weak Random Number Generation in Security Context HIGH

Use crypto.randomBytes() or crypto.randomUUID() for security-sensitive random values

+2 -1 javascript

- const token = Math.random().toString(36).substring(2);
+ const crypto = require('crypto');
+ const token = crypto.randomBytes(32).toString('hex');

🐍 Python 모두 보기 Python 자세히 →

Insecure Random Number Generation MEDIUM

Use the secrets module for tokens, passwords, and all security-sensitive randomness

+4 -5 python

- import random
- 
- def generate_token():
-     token = random.randint(100000, 999999)
-     return str(token)
+ import secrets
+ 
+ def generate_token():
+     return secrets.token_urlsafe(32)

Cryptographically Weak Random Number Generation MEDIUM

Use the secrets module instead of random for security-sensitive operations

+4 -5 python

- import random
- 
- def generate_token():
-     chars = 'abcdef0123456789'
-     return ''.join(random.choice(chars) for _ in range(32))
+ import secrets
+ 
+ def generate_token():
+     return secrets.token_hex(32)

핵심 실천 사항

Use of Math

3 탐지

코드에서 취약점 찾기

Shoulder를 사용하여 코드에서 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 패턴을 스캔하세요. 4 규칙.

터미널

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=338

# Or scan entire project
npx @shoulderdev/cli trust .

탐지 규칙 (4)

🐍 Python 2 rules

Insecure Random Number Generation MEDIUM

Detects use of insecure random number generators (random module) for security-critical operations. Use secrets module or os.urandom() for cryptographic randomness (tokens, passwords, keys, nonces).

Cryptographically Weak Random Number Generation MEDIUM

Detects use of the random module for security-sensitive operations like tokens, passwords, or cryptographic keys. The random module is not cryptographically secure. Use the secrets module instead.

🐹 Go 1 rules

Weak Random Number Generation for Security HIGH

Uses math/rand for security tokens, keys, or session IDs instead of crypto/rand.

🟨 Javascript 1 rules

Weak Random Number Generation in Security Context HIGH

Detects use of Math.random() for security-sensitive operations like generating tokens, session IDs, or cryptographic keys. Math.random() is not cryptographically secure and can be predicted by attackers.

🔷 Typescript 1 rules

Weak Random Number Generation in Security Context HIGH

4 경고 신호

코드 리뷰에서 주의할 점

이 패턴은 잠재적인 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 취약점을 나타냅니다. 코드 리뷰와 보안 감사 중에 찾아보세요.

🟠

math/rand used for security-sensitive random values go-weak-random-number-generation

🟠

Math.random() used for security-sensitive operation: ... javascript-weak-random

🟠

use of Math javascript-weak-random

🟡

use of insecure random number generators (random module) for security-critical operations python-insecure-randomness

🟡

use of the random module for security-sensitive operations like tokens, passwords, or cryptographic python-weak-random

🔍

코드베이스를 스캔하세요: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Shoulder CLI는 전체 코드베이스에서 취약한 패턴을 찾아냅니다.

npx shoulder trust 모든 규칙 보기