Vulnerability DatabaseCVE-2016-15005

CVE-2016-15005:
vulnerability analysis and mitigation

Overview

CSRF tokens in github.com/dinever/golf before v0.3.0 are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests (NVD, Go Packages).

Technical details

The vulnerability exists in the randomBytes function in xsrf.go which uses math.rand seeded with time.Now().UTC().UnixNano() to generate CSRF tokens. This implementation is unsafe as it uses a predictable seed value with a non-cryptographic random number generator, making the generated tokens predictable (GitHub Issue).

Impact

An attacker could predict CSRF token values due to the use of a non-cryptographic random number generator (math/rand) and predictable seed values. This allows bypassing CSRF protection mechanisms with relatively few requests, potentially leading to unauthorized actions being performed on behalf of authenticated users (Go Packages).

Mitigation and workarounds

The issue was fixed in version v0.3.0 by replacing math/rand with crypto/rand for CSRF token generation. The fix implements a cryptographically secure random number generator to ensure unpredictable token values (GitHub PR).