Junglewise Threat Intelligence

CVE-2015-8851: broofa node-uuid insecure entropy source in UUID generation

CVE-2015-8851 · Severity: low · CVSS 3.1 · Published 2020-04-16

Vendors: npm.

Executive brief

The node-uuid library, used for generating unique identifiers in Node.js applications, fails to use secure random number generation. This flaw makes the generated IDs predictable, potentially allowing attackers to guess sensitive tokens, session IDs, or file names, leading to unauthorized access or data exposure.

Technical details

The node-uuid library (prior to version 1.4.4) contains a logic error in its entropy selection mechanism. Due to an incorrect function call to the global require, the library consistently fails to load the cryptographically secure 'crypto' module and instead falls back to the insecure Math.random() function. This results in the generation of UUIDs with insufficient entropy (CWE-331). An attacker can exploit this predictability via brute-force or algorithmic guessing to predict future or past UUIDs, which is critical if the UUIDs are used for security-sensitive purposes like session tokens or CSRF protectors. The issue is resolved in version 1.4.4 by correcting the module loading logic.

Affected products

  • broofa node-uuid < 1.4.4

Timeline

  • 2015-08-13: patched: Fix committed in version 1.4.4
  • 2016-04-13: advisory: CVE assigned and disclosed via oss-security mailing list
  • 2020-04-16: disclosed: GitHub Advisory published

References