CWE-331: Insufficient Entropy

Description

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Potential Impact

Access Control, Other

Bypass Protection Mechanism, Other

Demonstrative Examples

This code generates a unique random identifier for a user's session.

Bad

function generateSessionID($userID){srand($userID);return rand();}

Because the seed for the PRNG is always the user's ID, the session ID will always be the same. An attacker could thus predict any user's session ID and potentially hijack the session.

This example also exhibits a Small Seed Space (CWE-339).

The following code uses a statistical PRNG to create a URL for a receipt that remains active for some period of time after a purchase.

Bad

String GenerateReceiptURL(String baseUrl) {Random ranGen = new Random();ranGen.setSeed((new Date()).getTime());return(baseUrl + ranGen.nextInt(400000000) + ".html");}

This code uses the Random.nextInt() function to generate "unique" identifiers for the receipt pages it generates. Because Random.nextInt() is a statistical PRNG, it is easy for an attacker to guess the strings it generates. Although the underlying design of the receipt system is also faulty, it would be more secure if it used a random number generator that did not produce predictable receipt identifiers, such as a cryptographic PRNG.

Mitigations & Prevention

Implementation

Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.

Detection Methods

Automated Static Analysis — Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then sea

Real-World CVE Examples

CVE ID	Description
CVE-2001-0950	Insufficiently random data used to generate session tokens using C rand(). Also, for certificate/key generation, uses a source that does not block when entropy is low.
CVE-2008-2108	Chain: insufficient precision (CWE-1339) in random-number generator causes some zero bits to be reliably generated, reducing the amount of entropy (CWE-331)

Taxonomy Mappings

PLOVER: — Insufficient Entropy
WASC: 11 — Brute Force
CERT C Secure Coding: MSC32-C — Properly seed pseudorandom number generators

Frequently Asked Questions

What is CWE-331?

CWE-331 (Insufficient Entropy) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

How can CWE-331 be exploited?

Attackers can exploit CWE-331 (Insufficient Entropy) to bypass protection mechanism, other. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.

How do I prevent CWE-331?

Key mitigations include: Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.

What is the severity of CWE-331?

CWE-331 is classified as a Base-level weakness (Medium abstraction). It has been observed in 2 real-world CVEs.