Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the CryptoJS.lib.WordArray.random function in crypto-js versions before 4.0.0. The analysis of the provided commits confirms this. The commit ff1f0032ff58aedfcc44eb6aa7b2c78207a98009 introduced a custom, weak pseudo-random number generator (PRNG) that replaced the previous direct usage of Math.random(). This custom PRNG, a variation of a Multiply-With-Carry generator, was seeded with the non-cryptographically secure Math.random(), leading to a small search space for generated secrets. The patch, introduced in commit b405ff597fb3ac76a7bdfbc72dca10ba1079b1d5 and released in version 4.0.0, rectifies this by replacing the weak PRNG with the platform's native cryptographic API (either Node.js crypto or the browser's Web Crypto API). Therefore, any application using CryptoJS.lib.WordArray.random from a vulnerable version to generate secrets is at risk.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| crypto-js | npm | < 4.0.0 | 4.0.0 |
