Summary
Data::Entropy for Perl uses remote entropy sources over plain HTTP with a weak integrity check, allowing on-path attackers to fully control the random data returned to applications.
When applications rely on these sources for rand_bits or rand_int, any attacker between the client and the entropy provider can substitute responses, undermining randomness and steering behavior such as retry and sleep logic.
Affected context
This issue arises in Perl applications that use Data::Entropy with remote entropy sources such as Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo.
The vulnerability is present when entropy is fetched over plain HTTP without strong integrity validation.
Environments with untrusted or semi-trusted networks—like public WiFi, captive portals, or proxied corporate egress—are particularly exposed because on-path entities can modify responses unnoticed.
Exploit preconditions
- Attack surface: Network traffic between the application and the remote entropy service
- Required access: On-path network position (e.g., open WiFi, compromised router/ISP, corporate proxy)
- Trigger point: Application calls to
with_entropy_source,rand_bits, orrand_intusing vulnerable remote sources - Why exploitation is possible: Entropy is transmitted over unencrypted HTTP and the integrity check trivially accepts any non-empty response, letting attackers inject chosen bytes and control retry/sleep behavior
Why this happens
The core flaw is reliance on unencrypted, unauthenticated HTTP for fetching critical randomness combined with an ineffective integrity check that accepts any non-empty byte string.
This pattern matches CWE-319: Cleartext Transmission of Sensitive Information, because entropy used for security decisions is treated as non-sensitive and sent without protection, and CWE-353: Missing Support for Integrity Check, as the integrity mechanism fails to validate authenticity or correctness.
At an abstract level, the design assumes remote randomness is trustworthy without cryptographic guarantees, allowing network attackers to deterministically replace random values with attacker-chosen bytes.
Potential impact
- Attackers may control all random values produced by
rand_bitsandrand_intwhen a vulnerable source is selected. - Security tokens, nonces, or keys derived from these random values could be predictable and easily reproduced.
- Probabilistic defenses (rate limiting, backoff algorithms, randomized retries) can be manipulated to favor attacker strategies.
- Game mechanics, lotteries, or other fairness-critical randomness may be biased or fully rigged.
- Long-term cryptographic or application secrets can be weakened, enabling broader compromise of affected systems.
General mitigation guidance
Mitigation typically centers on treating randomness as a security-sensitive asset and eliminating dependencies on unauthenticated remote entropy.
Recommended patterns include:
- Prefer local, OS-provided cryptographically secure random sources (e.g.,
/dev/urandom, modern RNG APIs). - If remote entropy is required, use HTTPS with strict certificate validation and well-defined authenticity guarantees.
- Implement robust integrity validation (e.g., MACs or digital signatures) for any externally-sourced entropy.
- Design retry and backoff mechanisms so they do not depend on attacker-controlled data and fail safely when entropy sources misbehave.
- Apply least-privilege principles so that randomness influenced by external services is not directly used for core secrets without additional hardening or mixing.
How teams detect issues like this
Detection efforts generally focus on identifying patterns where sensitive randomness depends on unprotected remote sources:
- Static analysis rules that flag uses of
Data::Entropy::RawSource::RandomOrg,RandomnumbersInfo, or similar HTTP-based entropy sources. - Code review checklists that require scrutiny for any non-local randomness, especially when used for keys, tokens, or probabilistic controls.
- Network security policies that monitor or block plain HTTP connections to known entropy providers and alert on such traffic.
- Configuration audits to ensure entropy sources used with
with_entropy_sourceare local, cryptographically secure, and properly authenticated. - Automated security testing that attempts to intercept and modify entropy responses in test environments to evaluate system robustness.
