CWE-331 Insufficient Entropy

Coverage: 4 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 4 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged "randomness" or secret generation that draws from predictable sources (timestamps, usernames, counters, short seeds), resulting in low entropy.

Why it matters

Low entropy enables guessing and replay attacks.

• Attackers can guess reset links/tokens or enumerate IDs.
• Weak entropy breaks assumptions across auth, crypto, and session management.

Safer examples

1) Use secure randomness APIs

Use crypto.randomBytes (Node) or secrets (Python) for tokens (see CWE-338 / R01).

2) Avoid "unique" != "unpredictable"

UUIDs and timestamps can be unique but still predictable; don't use them as secrets unless they are random UUIDs and long enough for the threat model.

3) Keep secrets long enough

Use at least 128 bits of entropy for security tokens and keys.

How SiteShadow detects it (high level)

• Flags token/key generation based on predictable inputs (time, counters, IDs, short seeds).
• Detects suspiciously short "secret" values in security-sensitive contexts.

References

• CWE-331: https://cwe.mitre.org/data/definitions/331.html

---

← Back to Vulnerability Library