Miggo Logo
Miggo Vulnerability Database
→
CVE-2016-15005

CVE-2016-15005: Golf may allow attacker to bypass CSRF protections due to weak PRNG

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2016-15005
GHSA ID
GHSA-q9qr-jwpw-3qvv
EPSS Score
0.11819%
CWE
CWE-332
Published
12/28/2022
Updated
8/29/2023
KEV Status
No
Technology
TechnologyGo

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
github.com/dinever/golfgo< 0.3.00.3.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the randomBytes function in xsrf.go using math/rand (with time.UTC().UnixNano() seeding) instead of a cryptographically secure PRNG. The commit 3776f33 explicitly replaces this implementation with crypto/rand, confirming this was the vulnerable component. The function's use of predictable random number generation directly enables CSRF token prediction as described in CWE-332 and CWE-352.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*SR* tok*ns *r* **n*r*t** usin* m*t*/r*n*, w*i** is not * *rypto*r*p*i**lly s**ur* r*n*om num**r **n*r*tor, *llowin* *n *tt**k*r to pr**i*t v*lu*s *n* *yp*ss *SR* prot**tions wit* r*l*tiv*ly **w r*qu*sts.

Reasoning

T** vuln*r**ility st*ms *rom t** r*n*om*yt*s *un*tion in xsr*.*o usin* m*t*/r*n* (wit* tim*.UT*().UnixN*no() s***in*) inst*** o* * *rypto*r*p*i**lly s**ur* PRN*. T** *ommit ******* *xpli*itly r*pl***s t*is impl*m*nt*tion wit* *rypto/r*n*, *on*irmin*