DerScanner
Home / Vulnerability Database / JavaScript : Weak random number generator
JavaScript

JavaScript : Weak random number generator

Classification

OWASP Top 10 2013
A6-Sensitive Data Exposure
OWASP Top 10 2017
A3-Sensitive Data Exposure
OWASP Top 10 2021
A2-Cryptographic FailuresA4-Insecure Design
OWASP MASVS
V3: 3.6.(L1/L2/L1+R/L2+R)V8: 8.13.(L1+R/L2+R)
OWASP ASVS
Stored CryptographyStored CryptographyStored CryptographyStored CryptographyAuthentication
PCI DSS 4.0
3.6.16.2.48.3.2
HIPAA
§164.312 (a)(2)(iv)
CWE
CWE-330CWE-338CWE-1032

Overview

Used pseudorandom number generator (PRNG) is not secure since it generates predictable sequence. This can be exploited to bypass authentication and hijack the user’s session, as well as to carry out the DNS cache poisoning attack.

PRNGs generate number sequences based on the initial value of the seed. There are two types of PRNG: statistical and cryptographic. Statistical PRNGs generate predictable sequences, which are similar to random according to the statistical characteristics. They must not be used for security purposes. The result of the cryptographic PRNG, on the contrary, is impossible to predict if the value of seed is derived from a source with high entropy. The value of the current time has a small entropy and is also insecure as a seed.

Sensitive Data Exposure vulnerabilities take the third place in the “OWASP Top 10 2017” web-application vulnerabilities ranking.

References

  1. OWASP Top 10 2017-A3-Sensitive Data Exposure
  2. OWASP: Insecure randomness
  3. CWE-330: Use of Insufficiently Random Values
  4. Some SecureRandom Thoughts - Alex Klyubin / Android Developers Blog
  5. CWE CATEGORY: OWASP Top Ten 2017 Category A6 - Security Misconfiguration
  6. CWE-338
LOW

DerScanner Severity Score

Do you want to fix JavaScript : Weak random number generator in your application?

See also

JavaScript

JavaScript : Null salt

JavaScript

JavaScript : Empty encryption key

JavaScript

JavaScript : Unsafe Azure access control