Executive brief
Fastly's JavaScript runtime for Compute@Edge edge computing uses a predictable random number seed that is compiled into each WebAssembly module. Applications relying on random number generation for cryptographic operations—such as generating encryption keys or session tokens—could have their security bypassed, potentially exposing sensitive data or allowing account takeover.
Technical details
The vulnerability stems from use of a CSPRNG (cryptographically secure pseudorandom number generator) seeded with a fixed value that is baked into the compiled WebAssembly module during build time, rather than initialized at runtime. An attacker with access to the deployed WebAssembly module can predict the entire sequence of random numbers produced by Math.random and crypto.getRandomValues, defeating cryptographic protocols that depend on unpredictable randomness. The attack requires no network access or authentication beyond knowledge of the compiled module. The vulnerability was introduced in version 0.4.0 and is fixed in version 0.5.3 by replacing the seeded CSPRNG with calls to WASI's random_get function, which provides true runtime randomness.
Affected products
- Fastly JS Compute Runtime 0.4.0 to 0.5.2
Timeline
- 2022-09-20: disclosed
- 2022-09-20: patched: Fixed in version 0.5.3