Query PR

github/codeql#10943

Language

Python

CVE(s) ID list

CVE-2022-25047
CVE-2022-29174
CVE-2020-28597

CWE

CWE-340: Generation of Predictable Numbers or Identifiers

Report

GUIDs (often called UUIDs) are widely used in modern web applications. One common use for UUIDs is the generation of one-time-use tokens. These can used for password reset, and e-mail confirmation routines, for example. There are five versions of UUIDs defined in RFC 4122. Out of the five, four are generated in a predictable manner. This means it is possible for someone to predict future UUIDs based on a sample generated by the target application. Version four is the only UUID version expected to be randomly generated. Therefore, for situations where predictable tokens are not desired (e.g. password reset tokens), all other versions should be avoided.

My queries look for instances where a call to an insecure GUID generation method flows into an attribute/variable that is potentially a token or security code.

Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc).

• Yes
• No

Blog post link

No response