CWE-331 Insufficient Entropy
What this means
SiteShadow flagged "randomness" or secret generation that draws from predictable sources (timestamps, usernames, counters, short seeds), resulting in low entropy.
Why it matters
Low entropy enables guessing and replay attacks.
- Attackers can guess reset links/tokens or enumerate IDs.
- Weak entropy breaks assumptions across auth, crypto, and session management.
Safer examples
1) Use secure randomness APIs
Use crypto.randomBytes (Node) or secrets (Python) for tokens (see CWE-338 / R01).
2) Avoid "unique" != "unpredictable"
UUIDs and timestamps can be unique but still predictable; don't use them as secrets unless they are random UUIDs and long enough for the threat model.
3) Keep secrets long enough
Use at least 128 bits of entropy for security tokens and keys.
How SiteShadow detects it (high level)
- Flags token/key generation based on predictable inputs (time, counters, IDs, short seeds).
- Detects suspiciously short "secret" values in security-sensitive contexts.
References
- CWE-331: https://cwe.mitre.org/data/definitions/331.html
---