Description

This detector identifies Rust applications that use weak pseudo-random number generators (PRNGs) to generate values for security-sensitive cookie tokens. Using non-cryptographically secure random number generators for authentication or session tokens can make them predictable and vulnerable to attacks, potentially leading to session hijacking or authentication bypass.

Detection Strategy

• The application imports a cookie library (using one of the recognized cookie import prefixes)

• The application imports one or more weak/non-cryptographic random number generator types from specific crates

• A cookie constructor is called in the code

• The first argument to the cookie constructor indicates it's a security-sensitive cookie (like session or authentication cookies)

• The second argument (cookie value) is generated using or derived from one of the imported weak random number generators

• All conditions above are met simultaneously for the same cookie creation statement

Vulnerable code example

use actix_web::cookie::Cookie;
use actix_web::{get, HttpResponse};
use rand::rngs::SmallRng;
use rand::{Rng, SeedableRng};

#[get("/login")]
async fn login() -> HttpResponse {
    let mut rng = SmallRng::from_entropy();...

✅ Secure code example

use actix_web::cookie::Cookie;
use actix_web::{get, HttpResponse};
use rand::rngs::StdRng; // Use cryptographically secure RNG instead of SmallRng
use rand::{Rng, SeedableRng};

#[get("/login")]
async fn login() -> HttpResponse {
    let mut rng = StdRng::from_entropy(); // StdRng is cryptographically secure for session IDs...