CWE-342, Predictable Exact Value from Previous Values, is when an exact value or random number can be precisely predicted by observing previous values.
Network stacks and anything that issues sequence numbers or tokens in order are the classic cases.
How it happens
If a generator is linear, sequential or has recoverable internal state, a few observations determine all later outputs. The observed examples are old but instructive:
- CVE-2002-1463: a firewall generated easily predictable initial sequence numbers, which allowed remote attackers to spoof connections.
- CVE-1999-0074: listening TCP ports were allocated sequentially, allowing spoofing attacks.
- CVE-1999-0077: predictable TCP sequence numbers allowed spoofing.
# Vulnerable: each ID is the previous plus one
next_id = last_id + 1
What an attacker gains
The record lists impact as varying by context. In the network cases, an attacker could spoof connections by injecting packets with the expected sequence number.
How to find it
The record lists no detection method. Collect a run of values from a test system and test whether the next can be computed from earlier ones. Differences that are constant or follow a formula are a warning.
How to fix it
MITRE's mitigations:
- Increase the entropy used to seed a PRNG.
- Use products or modules that conform to FIPS 140-2, and consult its approved generator list.
- Use a PRNG that periodically re-seeds itself from high quality sources, such as hardware devices with high entropy, but not so often that the entropy source blocks.
Where the value is a secret, draw each one independently from a secure source rather than deriving it from the last.
Quick check
Is a sequential ID always a flaw?
No, not when it is only a label. It is a flaw when knowing one value lets someone act as another party.
