✍️ Description

Random.setSeed should not be called with a constant integer argument. If a Random object is seeded with a specific value, the values returned by Random.nextInt() and similar methods which return or assign values are predictable.

🕵️‍♂️ Proof of Concept

Vulnerable code of: OxCaptcha.java:482

    public void noiseStrokes(int strokes, float width) {
        RAND.setSeed(49);
        _img_g.setStroke(new BasicStroke(width));
        _img_g.setColor(_fg_color);
        for (int i = 0; i < strokes; i++) {
            Path2D.Double path = new Path2D.Double();
            path.moveTo(RAND.nextInt(_width), RAND.nextInt(_height));
            path.curveTo(RAND.nextInt(_width), RAND.nextInt(_height), RAND.nextInt(_width), RAND.nextInt(_height),
                    RAND.nextInt(_width), RAND.nextInt(_height));
            _img_g.draw(path);
        }
    }

poc.php

#!/usr/bin/env php
<?php

if($argc < 3)
{
    print($argv[0] . ' <seed> <n>' . "\n");
    print('' . "\n");
    print('Parameters:' . "\n");
    print('  seed:   Seed to initialize mt_rand() with' . "\n");
    print('  offset: Number of calls to mt_rand() before printing the first');
    print(' output' . "\n");
    print('' . "\n");
    print('Output:' . "\n");
    print('  <offset>\'s call to mt_rand() and <offset+227>\'s call');
    print(' to mt_rand()' . "\n");
    exit();
}

mt_srand($argv[1]);
for($i=0;$i<$argv[2];$i++)
    mt_rand();

print mt_rand() . " ";
for($i=0;$i<226;$i++)
    mt_rand();
print mt_rand() . "\n";

💥 Impact

This vulnerability is capable of...