Small Space of Random Values
This vulnerability occurs when a system uses a random number generator that produces too few possible values. Attackers can easily predict or guess these values through brute force attacks.
When an application relies on random values for security—like generating session tokens, encryption keys, or password reset codes—using a random source with a small output space is a critical flaw. For example, a random number generator that only produces 65,536 possible values (16 bits) is trivial for an automated script to exhaustively try all combinations. This directly undermines security mechanisms designed to be unpredictable. To prevent this, developers must ensure their random value generators have an output space large enough to resist brute-force attempts for the required lifespan of the secret. This typically means using cryptographically secure pseudo-random number generators (CSPRNGs) that produce values with at least 128 bits of entropy. Always match the randomness strength to the sensitivity of the operation it protects.
Impact: Bypass Protection MechanismOther
An attacker could easily guess the values used. This could lead to unauthorized access to a system if the seed is used for authentication and authorization.
Strategy: Libraries or Frameworks
ID : DX-47
The following XML example code is a deployment descriptor for a Java web application deployed on a Sun Java Application Server. This deployment descriptor includes a session configuration property for configuring the session ID length.Code Example:
xml- PLOVER