CWE-340, Generation of Predictable Numbers or Identifiers, covers a scheme that generates numbers or identifiers that are more predictable than required. It is a parent category for several narrower predictability weaknesses.
Anything that issues IDs, filenames, ports, sequence numbers or tokens can be affected, from web apps to network stacks.
How it happens
The scheme works, but its output has structure an attacker can learn. A counter, a timestamp or a small generator all produce values that look unique and are not unguessable. Observed examples:
- CVE-2022-29330: a PBX administration product used predictable identifiers and timestamps for filenames.
- CVE-2001-1141: a PRNG let attackers use the output of small requests to determine internal state information, which could then predict later values.
- CVE-1999-0074: listening TCP ports were allocated sequentially, allowing spoofing attacks.
# Vulnerable: predictable filename
path = f"/exports/report_{int(time.time())}.csv"
What an attacker gains
The record lists impact as varying by context. Guessing an identifier can expose a file, an object or a session, or allow spoofed traffic.
How to find it
Static analysis can flag some cases. Review how every externally visible identifier is built, and ask whether knowing one value helps predict the next.
How to fix it
The record lists no mitigations, but the related entries point the same way. Generate identifiers from a cryptographically secure source with enough bits, keep access control on the resource so a guessed ID is not enough, and do not expose internal state through outputs.
path = f"/exports/{secrets.token_urlsafe(16)}.csv"
Quick check
Is a UUID a good identifier?
Only if generated from a secure source. And authorization checks should still apply.
