VNX-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

Reports generators that produce secrets seeded with a constant or the clock: seeded SecureRandom, setSeed(literal or currentTimeMillis), java.util.Random(time) for a token, and Python random.seed()/random.Random() with a fixed or time seed in a file that draws a secret from it.

Field	Value
Rule ID	`VNX-335`
Severity	High
SARIF level	`error`
Kind	`sast`
Languages	Java, Kotlin, Python
CWE	CWE-335
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H`
Tags	`prng` `seed` `cwe-335`
Source	`internal/sast/rules/vnx-335.rego`

Overview

VNX-335 maps to CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG). It reports a generator that produces secrets and is seeded with a value an attacker can reproduce: a literal, a string’s bytes, a constant, or the current time.

Why This Matters

A seeded generator replays the same sequence for the same seed. A SHA1PRNG SecureRandom seeded before its first use is fully deterministic, and a clock seed has only a few thousand plausible values around the time a token was issued.

What Gets Flagged

// FLAGGED: any explicit seed
SecureRandom r = new SecureRandom("fixed".getBytes());
// FLAGGED: clock seed on a SecureRandom
sr.setSeed(System.currentTimeMillis());
// FLAGGED: clock-seeded Random whose output becomes a token
private final Random random = new Random(System.currentTimeMillis());

# FLAGGED: the file then draws a token from random
random.seed(time.time())
rng = random.Random(1337)

What Is Not Flagged

Unseeded generators, and setSeed(generateSeed(...)), which only adds entropy.
Fixed seeds for simulations, shuffles and ML reproducibility (random.seed(42), numpy, torch) when no secret is drawn from the generator.
Files whose secrets come from the secrets module.
Comments and test files.

Remediation

Use new SecureRandom() or SecureRandom.getInstanceStrong() and never seed it; in Python use the secrets module, which cannot be seeded.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-335
// nosec vnx-335

Or record an ignore rule: vulnetix ignore add --rule vnx-335 --reason "...". See Suppressing findings.