ClassStableCWE-330

CWE-330: Use of Insufficiently Random Values

Description

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Abstraction: ClassAn abstract weakness, independent of any specific language or technology.
Likelihood of exploit: High
Status: Stable

Common consequences

ConfidentialityOther
Other
When a protection mechanism relies on random values to restrict access to a sensitive resource, such as a session ID or a seed for generating a cryptographic key, then the resource being protected could be accessed by guessing the ID or key.
Access ControlOther
Bypass Protection Mechanism; Other
If product relies on unique, unguessable IDs to identify a resource, an attacker might be able to guess an ID for a resource that is owned by another user. The attacker could then read the resource, or pre-create a resource with the same ID to prevent the legitimate program from properly sending the resource to the...
Access Control
Bypass Protection Mechanism; Gain Privileges or Assume Identity
When an authorization or authentication mechanism relies on random values to restrict access to restricted functionality, such as a session ID or a seed for generating a cryptographic key, then an attacker may access the restricted functionality by guessing the ID or key.

Potential mitigations

Architecture and Design
Use a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts. Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a random enough number.
Implementation
Consider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.
Architecture and DesignRequirementsLibraries or Frameworks
Use products or modules that conform to FIPS 140-2 to avoid obvious entropy problems. Consult FIPS 140-2 Annex C (Approved Random Number Generators).

Related weaknesses

Parent weaknesses

CWE-693Protection Mechanism Failure

Child weaknesses

Can lead to

CWE-804Guessable CAPTCHA

CAPEC attack patterns that exploit it

Common consequences

ConfidentialityOther

Other

When a protection mechanism relies on random values to restrict access to a sensitive resource, such as a session ID or a seed for generating a cryptographic key, then the resource being protected could be accessed by guessing the ID or key.

Access ControlOther

Bypass Protection Mechanism; Other

If product relies on unique, unguessable IDs to identify a resource, an attacker might be able to guess an ID for a resource that is owned by another user. The attacker could then read the resource, or pre-create a resource with the same ID to prevent the legitimate program from properly sending the resource to the...

Access Control

Bypass Protection Mechanism; Gain Privileges or Assume Identity

When an authorization or authentication mechanism relies on random values to restrict access to restricted functionality, such as a session ID or a seed for generating a cryptographic key, then an attacker may access the restricted functionality by guessing the ID or key.

Potential mitigations

Architecture and Design

Use a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds. In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts. Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a random enough number.

Implementation

Consider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.

Architecture and DesignRequirementsLibraries or Frameworks

Use products or modules that conform to FIPS 140-2 to avoid obvious entropy problems. Consult FIPS 140-2 Annex C (Approved Random Number Generators).