VNX-331: Insufficient Entropy

Reports secrets generated from fewer than 16 random bytes (secrets.token_*, os.urandom, crypto.randomBytes, PHP random_bytes, Ruby SecureRandom.hex, short byte[]/ByteArray salts and keys) or from uuid1() and truncated uuid4(), when the value is named as a token, secret, key, salt or session id.

Field	Value
Rule ID	`VNX-331`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Java, Kotlin, JavaScript / TypeScript, PHP, Python, Ruby
CWE	CWE-331
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`insufficient-entropy` `cwe-331` `crypto`
Source	`internal/sast/rules/vnx-331.rego`

Overview

VNX-331 maps to CWE-331: Insufficient Entropy. It reports a secret generated with less than 128 bits of randomness, when the same line names it as a token, secret, key, password, salt, session id, CSRF, API key, reset or invite value.

Why This Matters

A good generator does not help if it is asked for four bytes: 32 bits can be enumerated, and a short salt or key loses most of its protection. uuid1() is built from a timestamp and the host’s MAC address, not randomness.

What Gets Flagged

# FLAGGED
api_key = secrets.token_hex(4)
salt = os.urandom(4)
token = str(uuid.uuid1())
invite_token = uuid.uuid4().hex[:8]

// FLAGGED
const token = crypto.randomBytes(4).toString('hex');

// FLAGGED: an 8-byte salt filled by nextBytes()
byte[] salt = new byte[8];

What Is Not Flagged

16 bytes or more, and the secrets defaults (32 bytes).
Short random values with no security name (file names, colours, trace ids).
Nonces and IVs, whose size is set by the cipher (a 12-byte GCM nonce is correct).
uuid4() in full, comments and test files.

Non-cryptographic generators are reported by VNX-PY-005 and VNX-JAVA-016; small numeric ranges by VNX-334.

Remediation

Use at least 16 random bytes from a CSPRNG for every secret: secrets.token_urlsafe(32), crypto.randomBytes(32), or a 16+ byte array filled by SecureRandom.nextBytes.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-331
// nosec vnx-331

Or record an ignore rule: vulnetix ignore add --rule vnx-331 --reason "...". See Suppressing findings.