CWE-340 (可预测问题) — Vulnerability Class 36

CWE-340 represents a critical weakness where software generates numbers or identifiers with insufficient entropy, making them predictable to attackers. This flaw typically arises when developers rely on basic pseudo-random number generators or sequential counters for security-sensitive contexts like session tokens, cryptographic keys, or access controls. Attackers exploit this by analyzing patterns or brute-forcing the predictable sequence to hijack user sessions, escalate privileges, or bypass authentication mechanisms entirely. To mitigate this risk, developers must employ cryptographically secure pseudo-random number generators (CSPRNGs) that provide high entropy and resistance to prediction. Additionally, avoiding sequential identifiers for security purposes and implementing proper randomness seeding are essential practices. By ensuring that generated values are statistically random and unpredictable, organizations can significantly reduce the attack surface associated with identifier guessing and maintain the integrity of their security controls.