CWE-330 Use of Insufficiently Random Values

Coverage: 7 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 7 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged values that are meant to be unpredictable (tokens, IDs, salts, nonces) but are generated with insufficient randomness.

Why it matters

Predictable values can be brute-forced or guessed.

• Token guessing can lead to account takeover or unauthorized access.
• Security bypass when "random" IDs become enumerable or predictable.
• Weak randomness often undermines otherwise-correct security designs.

Safer examples

1) Use a cryptographically secure RNG

See CWE-338 / R01 for concrete examples.

2) Use adequate length/entropy

Use at least 128 bits of entropy for tokens and reset links.

3) Avoid predictable sources

Don't derive secrets from timestamps, user IDs, counters, or Math.random().

How SiteShadow detects it (high level)

• Flags weak RNG usage in security-sensitive contexts.
• Detects token generation patterns based on predictable inputs (time, counters, IDs).

References

• CWE-330: https://cwe.mitre.org/data/definitions/330.html

---

← Back to Vulnerability Library