Description

Detects the use of weak random number generators when generating cookie values in Java applications. Using predictable random numbers for cookies can allow attackers to guess or predict session identifiers and other sensitive cookie values, potentially leading to session hijacking attacks.

Detection Strategy

• Identifies calls to addCookie() method in Java code

• Examines the cookie value generation to check if it uses weak random number generators (like java.util.Random)

• Reports a vulnerability when cookies are created using weak random number generation methods instead of secure alternatives like SecureRandom

• Specifically looks at the object and arguments used in the addCookie call to determine if weak randomization is used

Vulnerable code example

import javax.servlet.http.HttpServletRequest;
import java.util.Random;

public class VulnerableRandomExample {
    public void doPost(HttpServletRequest request) {
        // Vulnerable: Using java.util.Random() for security-sensitive token generation
        long randomValue = new Random().nextLong();
        String rememberMeKey = Long.toString(randomValue);...

✅ Secure code example

import javax.servlet.http.HttpServletRequest;
import java.security.SecureRandom; // Using SecureRandom instead of Random
import java.util.Base64;

public class SecureRandomExample {
    private final SecureRandom secureRandom = new SecureRandom(); // Create single instance for reuse
    
    public void doPost(HttpServletRequest request) {...