Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

When a non-cryptographic PRNG is used in a security context (such as generating session tokens or cryptographic keys), an attacker may be able to predict its output and compromise the security mechanism.

Rozpowszechnienie

Wysoka

Często wykorzystywana

Wplyw

Wysoki

2 reguł o wysokim poziomie

Zapobieganie

Udokumentowane

4 przykładów poprawek

2 Zapobieganie

Jak naprawić tę podatność

Strategie zapobiegania dla Weak PRNG oparte na 4 regułach detekcji Shoulder.

🐹 Go Zobacz wszystko Go szczegóły →

Weak Random Number Generation for Security HIGH

Use crypto/rand instead of math/rand for security-sensitive values

+8 -6 go

- import "math/rand"
- 
- func generateToken() string {
-     token := make([]byte, 32)
-     rand.Read(token)
-     return hex.EncodeToString(token)
+ import "crypto/rand"
+ 
+ func generateToken() (string, error) {
+     token := make([]byte, 32)
+     if _, err := rand.Read(token); err != nil {
+         return "", err
+     }
+     return hex.EncodeToString(token), nil
  }

🟨 JavaScript Zobacz wszystko JavaScript szczegóły →

Weak Random Number Generation in Security Context HIGH

Use crypto.randomBytes() or crypto.randomUUID() for security-sensitive random values

+2 -1 javascript

- const token = Math.random().toString(36).substring(2);
+ const crypto = require('crypto');
+ const token = crypto.randomBytes(32).toString('hex');

🐍 Python Zobacz wszystko Python szczegóły →

Insecure Random Number Generation MEDIUM

Use the secrets module for tokens, passwords, and all security-sensitive randomness

+4 -5 python

- import random
- 
- def generate_token():
-     token = random.randint(100000, 999999)
-     return str(token)
+ import secrets
+ 
+ def generate_token():
+     return secrets.token_urlsafe(32)

Cryptographically Weak Random Number Generation MEDIUM

Use the secrets module instead of random for security-sensitive operations

+4 -5 python

- import random
- 
- def generate_token():
-     chars = 'abcdef0123456789'
-     return ''.join(random.choice(chars) for _ in range(32))
+ import secrets
+ 
+ def generate_token():
+     return secrets.token_hex(32)

Kluczowe praktyki

Use of Math

3 Wykrywanie

Znajdz podatnosci w swoim kodzie

Uzyj Shoulder do skanowania kodu w poszukiwaniu wzorcow Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). 4 reguly.

terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=338

# Or scan entire project
npx @shoulderdev/cli trust .

Reguly Wykrywania (4)

🐍 Python 2 rules

Insecure Random Number Generation MEDIUM

Detects use of insecure random number generators (random module) for security-critical operations. Use secrets module or os.urandom() for cryptographic randomness (tokens, passwords, keys, nonces).

Cryptographically Weak Random Number Generation MEDIUM

Detects use of the random module for security-sensitive operations like tokens, passwords, or cryptographic keys. The random module is not cryptographically secure. Use the secrets module instead.

🐹 Go 1 rules

Weak Random Number Generation for Security HIGH

Uses math/rand for security tokens, keys, or session IDs instead of crypto/rand.

🟨 Javascript 1 rules

Weak Random Number Generation in Security Context HIGH

Detects use of Math.random() for security-sensitive operations like generating tokens, session IDs, or cryptographic keys. Math.random() is not cryptographically secure and can be predicted by attackers.

🔷 Typescript 1 rules

Weak Random Number Generation in Security Context HIGH

4 Sygnaly Ostrzegawcze

Na co zwracac uwage podczas przegladu kodu

Te wzorce wskazuja na potencjalne podatnosci Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). Szukaj ich podczas przegladow kodu i audytow bezpieczenstwa.

🟠

math/rand used for security-sensitive random values go-weak-random-number-generation

🟠

Math.random() used for security-sensitive operation: ... javascript-weak-random

🟠

use of Math javascript-weak-random

🟡

use of insecure random number generators (random module) for security-critical operations python-insecure-randomness

🟡

use of the random module for security-sensitive operations like tokens, passwords, or cryptographic python-weak-random

🔍

Przeskanuj swój kod w poszukiwaniu Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Shoulder CLI znajduje podatne wzorce w całym Twoim kodzie.

npx shoulder trust Przeglądaj wszystkie reguły