VNX-1241: Use of Predictable Algorithm in Random Number Generator
A java.util.Random, whose linear congruential algorithm is fully determined by its 48-bit seed, is given an explicit seed in production Java code, so every value it produces can be reproduced by anyone who knows or guesses the seed (a constant, the clock, a counter or a value derived from user data). Reported: new Random(<seed>) and new java.util.Random(<seed>) with any argument (a literal, a constant, System.currentTimeMillis()/nanoTime(), an expression), and <name>.setSeed(...) on a variable or field the same file declares as Random or assigns new Random(...). Not reported: new Random() with no seed (whether its use is security-sensitive is judged by VNX-JAVA-016), SecureRandom and its setSeed (which adds entropy rather than replacing it; seeding SecureRandom is VNX-335), other classes whose name merely contains Random, a method that is itself named setSeed, test code, comments and string literals.
| Field | Value |
|---|---|
| Rule ID | VNX-1241 |
| Severity | Medium |
| SARIF level | warning |
| Kind | sast |
| Languages | Java |
| CWE | CWE-1241 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C |
| Tags | predictable-rng java cwe-1241 |
| Source | internal/sast/rules/vnx-1241.rego |
Overview
VNX-1241 maps to CWE-1241: Use of Predictable Algorithm in Random Number Generator.
Why This Matters
java.util.Random is a 48-bit linear congruential generator. Its whole output follows from the seed, so a generator seeded with a constant, the clock or a value derived from user data produces values anyone can reproduce. Reset links, session ids and OTPs drawn from it can be predicted.
What Gets Flagged
private final Random rng = new Random(42L);
Random random = new Random(System.currentTimeMillis());
random.setSeed(key.length()); // random declared as java.util.RandomNot flagged: new Random() with no seed, SecureRandom and its setSeed, a method of your own named setSeed, test code.
Remediation
- Use
java.security.SecureRandomfor any value an attacker must not predict, and do not seed it yourself. - Keep seeded
java.util.Randomfor simulations and tests only.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-1241
// nosec vnx-1241Or record an ignore rule: vulnetix ignore add --rule vnx-1241 --reason "...". See Suppressing findings.