Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

When a non-cryptographic PRNG is used in a security context (such as generating session tokens or cryptographic keys), an attacker may be able to predict its output and compromise the security mechanism.

普遍性

高

频繁被利用

影响

高

2 条严重级别为高的规则

预防

已记录

4 个修复示例

2 预防

如何修复此漏洞

基于 4 条 Shoulder 检测规则的 Weak PRNG 预防策略。

🐹 Go 查看全部 Go 详情 →

Weak Random Number Generation for Security HIGH

Use crypto/rand instead of math/rand for security-sensitive values

+8 -6 go

- import "math/rand"
- 
- func generateToken() string {
-     token := make([]byte, 32)
-     rand.Read(token)
-     return hex.EncodeToString(token)
+ import "crypto/rand"
+ 
+ func generateToken() (string, error) {
+     token := make([]byte, 32)
+     if _, err := rand.Read(token); err != nil {
+         return "", err
+     }
+     return hex.EncodeToString(token), nil
  }

🟨 JavaScript 查看全部 JavaScript 详情 →

Weak Random Number Generation in Security Context HIGH

Use crypto.randomBytes() or crypto.randomUUID() for security-sensitive random values

+2 -1 javascript

- const token = Math.random().toString(36).substring(2);
+ const crypto = require('crypto');
+ const token = crypto.randomBytes(32).toString('hex');

🐍 Python 查看全部 Python 详情 →

Insecure Random Number Generation MEDIUM

Use the secrets module for tokens, passwords, and all security-sensitive randomness

+4 -5 python

- import random
- 
- def generate_token():
-     token = random.randint(100000, 999999)
-     return str(token)
+ import secrets
+ 
+ def generate_token():
+     return secrets.token_urlsafe(32)

Cryptographically Weak Random Number Generation MEDIUM

Use the secrets module instead of random for security-sensitive operations

+4 -5 python

- import random
- 
- def generate_token():
-     chars = 'abcdef0123456789'
-     return ''.join(random.choice(chars) for _ in range(32))
+ import secrets
+ 
+ def generate_token():
+     return secrets.token_hex(32)

关键实践

Use of Math

3 检测

查找代码中的漏洞

使用Shoulder扫描代码中的Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)模式。 4 规则.

终端

# Scan with Shoulder CLI
npx @shoulderdev/cli trust --cwe=338

# Or scan entire project
npx @shoulderdev/cli trust .

检测规则 (4)

🐍 Python 2 rules

Insecure Random Number Generation MEDIUM

Detects use of insecure random number generators (random module) for security-critical operations. Use secrets module or os.urandom() for cryptographic randomness (tokens, passwords, keys, nonces).

Cryptographically Weak Random Number Generation MEDIUM

Detects use of the random module for security-sensitive operations like tokens, passwords, or cryptographic keys. The random module is not cryptographically secure. Use the secrets module instead.

🐹 Go 1 rules

Weak Random Number Generation for Security HIGH

Uses math/rand for security tokens, keys, or session IDs instead of crypto/rand.

🟨 Javascript 1 rules

Weak Random Number Generation in Security Context HIGH

Detects use of Math.random() for security-sensitive operations like generating tokens, session IDs, or cryptographic keys. Math.random() is not cryptographically secure and can be predicted by attackers.

🔷 Typescript 1 rules

Weak Random Number Generation in Security Context HIGH

4 警告信号

代码审查中需要关注的内容

这些模式表明潜在的Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)漏洞。在代码审查和安全审计中注意查找。

🟠

math/rand used for security-sensitive random values go-weak-random-number-generation

🟠

Math.random() used for security-sensitive operation: ... javascript-weak-random

🟠

use of Math javascript-weak-random

🟡

use of insecure random number generators (random module) for security-critical operations python-insecure-randomness

🟡

use of the random module for security-sensitive operations like tokens, passwords, or cryptographic python-weak-random

🔍

扫描你的代码库: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Shoulder CLI 在整个代码库中找到易受攻击的模式。

npx shoulder trust 浏览所有规则