diff --git a/src/PSProxmoxVE.Core/Client/PveHttpClient.cs b/src/PSProxmoxVE.Core/Client/PveHttpClient.cs
index 36df156..76d4512 100644
--- a/src/PSProxmoxVE.Core/Client/PveHttpClient.cs
+++ b/src/PSProxmoxVE.Core/Client/PveHttpClient.cs
@@ -4,6 +4,7 @@ using System.IO;
using System.Net;
using System.Net.Http;
using System.Net.Http.Headers;
+using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using Newtonsoft.Json.Linq;
@@ -387,14 +388,20 @@ namespace PSProxmoxVE.Core.Client
return body.Length > 512 ? body.Substring(0, 512) + "..." : body;
}
- /// Generates a random 32-character alphanumeric boundary string.
+ /// Generates a random 32-character alphanumeric boundary string using a cryptographic RNG.
private static string GenerateBoundary()
{
const string chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
- var rng = new Random();
+ var bytes = new byte[32];
+#if NET48 || NETSTANDARD2_0
+ using (var rng = RandomNumberGenerator.Create())
+ rng.GetBytes(bytes);
+#else
+ RandomNumberGenerator.Fill(bytes);
+#endif
var sb = new StringBuilder(32);
for (int i = 0; i < 32; i++)
- sb.Append(chars[rng.Next(chars.Length)]);
+ sb.Append(chars[bytes[i] % chars.Length]);
return sb.ToString();
}