CWE-342 (从先前值可预测准确值) — Vulnerability Class 6

CWE-342 represents a critical weakness in cryptographic and security systems where the output of a random number generator is deterministic rather than truly random. This flaw allows attackers to predict future values by analyzing a sequence of previously observed outputs, effectively breaking the assumption of unpredictability required for secure operations. Exploitation typically involves capturing initial outputs, such as session tokens or encryption keys, and using statistical analysis or known algorithmic patterns to forecast subsequent values. This enables unauthorized access, session hijacking, or data decryption. To mitigate this risk, developers must implement cryptographically secure pseudorandom number generators (CSPRNGs) that incorporate sufficient entropy from multiple unpredictable sources. Regular auditing of randomization logic and avoiding custom implementations are essential practices to ensure that generated values remain statistically independent and resistant to prediction attacks.