Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

When a non-cryptographic PRNG is used in a security context (such as generating session tokens or cryptographic keys), an attacker may be able to predict its output and compromise the security mechanism.

Prevalência

Alta

Frequentemente explorada

Impacto

Alto

2 regras de severidade alta

Prevenção

Documentada

4 exemplos de correção

2 Prevenção

Como corrigir esta vulnerabilidade

Estratégias de prevenção para Weak PRNG baseadas em 4 regras de detecção do Shoulder.

🐹 Go Ver tudo Go detalhes →

Weak Random Number Generation for Security HIGH

Use crypto/rand instead of math/rand for security-sensitive values

+8 -6 go

- import "math/rand"
- 
- func generateToken() string {
-     token := make([]byte, 32)
-     rand.Read(token)
-     return hex.EncodeToString(token)
+ import "crypto/rand"
+ 
+ func generateToken() (string, error) {
+     token := make([]byte, 32)
+     if _, err := rand.Read(token); err != nil {
+         return "", err
+     }
+     return hex.EncodeToString(token), nil
  }

🟨 JavaScript Ver tudo JavaScript detalhes →

Weak Random Number Generation in Security Context HIGH

Use crypto.randomBytes() or crypto.randomUUID() for security-sensitive random values

+2 -1 javascript

- const token = Math.random().toString(36).substring(2);
+ const crypto = require('crypto');
+ const token = crypto.randomBytes(32).toString('hex');

🐍 Python Ver tudo Python detalhes →

Insecure Random Number Generation MEDIUM

Use the secrets module for tokens, passwords, and all security-sensitive randomness

+4 -5 python

- import random
- 
- def generate_token():
-     token = random.randint(100000, 999999)
-     return str(token)
+ import secrets
+ 
+ def generate_token():
+     return secrets.token_urlsafe(32)

Cryptographically Weak Random Number Generation MEDIUM

Use the secrets module instead of random for security-sensitive operations

+4 -5 python

- import random
- 
- def generate_token():
-     chars = 'abcdef0123456789'
-     return ''.join(random.choice(chars) for _ in range(32))
+ import secrets
+ 
+ def generate_token():
+     return secrets.token_hex(32)

Práticas-chave

Use of Math

3 Detecção

Encontre vulnerabilidades no seu código

Use o Shoulder para escanear seu código em busca de padrões Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). 4 regras.

terminal

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=338

# Or scan entire project
npx @shoulderdev/cli trust .

Regras de Detecção (4)

🐍 Python 2 rules

Insecure Random Number Generation MEDIUM

Detects use of insecure random number generators (random module) for security-critical operations. Use secrets module or os.urandom() for cryptographic randomness (tokens, passwords, keys, nonces).

Cryptographically Weak Random Number Generation MEDIUM

Detects use of the random module for security-sensitive operations like tokens, passwords, or cryptographic keys. The random module is not cryptographically secure. Use the secrets module instead.

🐹 Go 1 rules

Weak Random Number Generation for Security HIGH

Uses math/rand for security tokens, keys, or session IDs instead of crypto/rand.

🟨 Javascript 1 rules

Weak Random Number Generation in Security Context HIGH

Detects use of Math.random() for security-sensitive operations like generating tokens, session IDs, or cryptographic keys. Math.random() is not cryptographically secure and can be predicted by attackers.

🔷 Typescript 1 rules

Weak Random Number Generation in Security Context HIGH

4 Sinais de Alerta

O que observar nas revisões de código

Estes padrões indicam vulnerabilidades potenciais de Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG). Procure-os durante revisões de código e auditorias de segurança.

🟠

math/rand used for security-sensitive random values go-weak-random-number-generation

🟠

Math.random() used for security-sensitive operation: ... javascript-weak-random

🟠

use of Math javascript-weak-random

🟡

use of insecure random number generators (random module) for security-critical operations python-insecure-randomness

🟡

use of the random module for security-sensitive operations like tokens, passwords, or cryptographic python-weak-random

🔍

Escaneie seu código para Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

O Shoulder CLI encontra padrões vulneráveis em todo o seu código.

npx shoulder trust Ver todas as regras