Zennoxa Shield
Rules / C#
SHIELD-CSHARP-016

Insecure random used for security tokens

mediumC#CWE-338CVSS 6.5

What it detects

System.Random is used to generate values that appear to be security tokens or keys.

How to fix

Use RandomNumberGenerator or RNGCryptoServiceProvider for security-sensitive random values.

Vulnerable — Shield flags thisResetTokenService.cs
public class ResetTokenService
{
    public string CreateResetCode()
    {
        // Predictable: System.Random is not cryptographically secure
        var code = new Random().Next(100000, 999999).ToString();
        return code;
    }
}
Fixed — scans cleanResetTokenService.cs
using System.Security.Cryptography;

public class ResetTokenService
{
    public string CreateResetCode()
    {
        var bytes = RandomNumberGenerator.GetBytes(8);
        return Convert.ToHexString(bytes);
    }
}

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-CSHARP-016, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-CSHARP-016: Insecure random used for security tokens — Zennoxa Shield