T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/script.sh:547- Finding
Passwords Generated with a Non-Cryptographic Pseudorandom Number Generator
- Content
View full analysis
?" for _ in range(count): pwd = ''.join(random.choices(chars, k=length)) # Ensure at least one of each required type if length >= 4: pwd_list = list(pwd) pwd_list[0] = random.choice(string.ascii_uppercase) pwd_list[1] = random.choice(string.ascii_lowercase) pwd_list[2] = random.choice(string.digits) if not no_special: pwd_list[3] = random.choice("!@#$%^&*()-_=+") random.shuffle(pwd_list) pwd = ''.join(pwd_list) print(pwd) ``` ### Technical Analysis The password command uses Python's `random` module for every security-relevant operation, including character selection and shuffling. This module uses the Mersenne Twister algorithm, which is designed for simulation rather than cryptographic security. Its internal state is deterministic, and future output can be predicted if that state is compromised or reconstructed from sufficient observations. Adding mandatory character classes does not correct the underlying predictability because the replacement characters and final shuffle also use the same non-cryptographic generator. Although the Skill is presented as a test-data generator, the command is explicitly named `password`, and its documentation does not warn users that its output is unsuitable for real credentials. ### Attack Path 1. A user invokes `bash scripts/script.sh password` and uses the result as an authentication credential or secret. 2. An attacker obtains sufficient information about the Python PRNG state, such as through state disclosure, predictable execution conditions, or a broader process compromise. 3. Because password character selection and shuff ...[truncated 843 chars]- Remediation
View remediation