# Cwe 330 Weak Prng

> Use this skill when you need to remediate CWE-330 (Use of Insufficiently Random Values) vulnerabilities in Java code. Triggers on SAST findings, security reviews, or when fixing use of insufficiently random values issues.

- Skill: `developerscoffee/cwe-330-weak-prng` (Agent Skill)
- Install (CLI): `npx skillmds@latest add developerscoffee/cwe-330-weak-prng`
- Raw SKILL.md: https://api.skillmd.com/api/skills/developerscoffee/cwe-330-weak-prng/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: DevelopersCoffee (https://skillmd.com/u/developerscoffee)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/developerscoffee/cwe-330-weak-prng

---


# CWE-330 Use of Insufficiently Random Values

## Description

Use of Insufficiently Random Values

Reference:
https://cwe.mitre.org/data/definitions/330.html


**OWASP Category**: A02:2021 – Cryptographic Failures


---

## Vulnerable Pattern


### ❌ Example 1

```java
    public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel1(
            @RequestParam Map<String, String> queryParams) {
        String password = queryParams.get(PASSWORD_PARAM);

        // No password param: return the challenge hash
        if (password == null || password.isEmpty()) {
            return new ResponseEntity<>(
                    new GenericVulnerabilityResponseBean<>(
                            "CHALLENGE: A user's password is stored as MD5 hash: "
                                    + LEVEL1_HASH
                                    + " — Crack it and enter the original password!",
                            false),
                    HttpStatus.OK);
        }

        // Verify the guess
        String guessHash = DigestUtils.md5Hex(password);
        if (guessHash.equals(LEVEL1_HASH)) {
        // ... (truncated for brevity)
```





---

## Deterministic Fix


### ✅ Secure Implementation

```java
    public ResponseEntity<GenericVulnerabilityResponseBean<String>> getVulnerablePayloadLevel4(
            @RequestParam Map<String, String> queryParams) {
        String password = queryParams.get(PASSWORD_PARAM);

        if (password == null || password.isEmpty()) {
            return new ResponseEntity<>(
                    new GenericVulnerabilityResponseBean<>(
                            "CHALLENGE: The system 'encrypts' passwords using Base64 encoding. "
                                    + "The stored password is: "
                                    + LEVEL4_ENCODED
                                    + " — Decode it and enter the original password!",
                            false),
                    HttpStatus.OK);
        }

        if (password.equals(LEVEL4_SECRET)) {
            return new ResponseEntity<>(
                    new GenericVulnerabilityResponseBean<>(
                            "Correct! The password was '"
                                    + LEVEL4_SECRET
                                    + "'. Base64 is an encoding, NOT encryption."
                                    + " It provides zero security — anyone can decode it instantly.",
                            true),
                    HttpStatus.OK);
        } else {
        // ... (truncated for brevity)
```





---

## Detection Pattern

Look for these patterns in your codebase:


```bash
# Find insecure random usage
grep -rn "new Random()\|Math.random()" --include="*.java"
```


```bash
# Find security-related random usage
grep -rn "token\|secret\|key" --include="*.java" | grep -i random
```



---

## Remediation Steps


1. Replace Random with SecureRandom for security-sensitive values

2. Use SecureRandom for session tokens, CSRF tokens, API keys

3. Ensure sufficient entropy in random generation

4. Avoid seeding SecureRandom with predictable values


---

## Key Imports

```java

import java.security.SecureRandom;

import java.util.UUID;

```

---

## Verification

After remediation:


- Re-run SAST scan - CWE-330 should be resolved

- Verify SecureRandom is used for security tokens

- Check that tokens are not predictable


---

## Trigger Examples

```
Fix CWE-330 vulnerability
Resolve Use of Insufficiently Random Values issue
Secure this Java code against use of insufficiently random values
SAST reports CWE-330
```

---

## Common Vulnerable Locations

| Layer | Files | Patterns |
|-------|-------|----------|

| Security | `*Token*.java` | Token generation |

| Utility | `*Util.java` | ID generation |

| Service | `*Service.java` | Secret generation |


---

## References


- [CWE-330: Insufficient Randomness](https://cwe.mitre.org/data/definitions/330.html)

- [OWASP Cryptographic Failures](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/)


---

**Source**: Generated by [Java CWE Security Skills Generator](https://github.com/DevelopersCoffee/java-cwe-security-skills)
**Last Updated**: 2026-03-07