Executive brief
randomatic is a Node.js library for generating random strings and patterns. The library uses a cryptographically weak random number generator, allowing an attacker to predict the values it generates instead of receiving truly random output. This could compromise applications that rely on randomatic for security-sensitive operations like token generation or cryptographic nonce creation.
Technical details
randomatic generates random values using Math.random() instead of a cryptographically secure random number generator, making the output predictable (CWE-330, CWE-338). The vulnerability affects all versions prior to 3.0.0, which introduced the use of the crypto module for secure randomness. An unauthenticated network attacker can predict random values generated by the library, compromising any security-dependent functionality relying on randomatic for randomness. Applications using the library for token generation, nonce creation, or other cryptographic purposes are particularly at risk.
Affected products
- jonschlinkert randomatic 0 to 2.3.0
Timeline
- 2018-10-09: disclosed
- 2018-10-09: patched: Version 3.0.0 released with cryptographically secure random generation