I discovered a security vulnerability in the RELATE project related to
the use of a non-cryptographic PRNG for security-sensitive token
generation.
Location 1: course/auth.py → make_sign_in_key()
def make_sign_in_key(user: User) -> str:
import random ** * # ← Mersenne Twister (not cryptographic)***
from time import time
m = hashlib.sha1()
m.update(user.email.encode("utf-8"))
m.update(hex(random.getrandbits(128)).encode()) # predictable
m.update(str(time()).encode("utf-8"))
return m.hexdigest()This token is used for:
- Password reset links
- Email-based sign-in
- API authentication tokens
Location 2: course/exam.py → gen_ticket_code()
def gen_ticket_code():
from random import choice # ← PRNG, not CSPRNG
return "".join(choice(ticket_alphabet) for _i in range(8))
This token is used for exam ticket codes.
Impact
Python's random module uses Mersenne Twister which is not
cryptographically secure. An attacker who observes enough
outputs can predict future tokens, potentially allowing:
- Account takeover via password reset token prediction
- Unauthorized exam access via ticket code prediction
Recommended Fix
Location 1:
import secrets
def make_sign_in_key(user: User) -> str:
return secrets.token_hex(32)**
Location 2:
import secrets
ticket_alphabet =
"ABCDEFGHJKLPQRSTUVWXYZabcdefghjkpqrstuvwxyz23456789"
def gen_ticket_code():
return "".join(secrets.choice(ticket_alphabet) for _ in range(8))
Credit: Ruslan Amrahov
I discovered a security vulnerability in the RELATE project related to
the use of a non-cryptographic PRNG for security-sensitive token
generation.
Location 1: course/auth.py → make_sign_in_key()
This token is used for:
Location 2: course/exam.py → gen_ticket_code()
This token is used for exam ticket codes.
Impact
Python's random module uses Mersenne Twister which is not
cryptographically secure. An attacker who observes enough
outputs can predict future tokens, potentially allowing:
Recommended Fix
Location 1:
Location 2:
Credit: Ruslan Amrahov