CWE-307: Improper Restriction of Excessive Authentication Attempts (Base)

Description: The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.




Applicable Platforms: ::LANGUAGE CLASS:Not Language-Specific:LANGUAGE PREVALENCE:Undetermined::

Modes of Introduction: ::PHASE:Architecture and Design:NOTE:COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.::



Common Consequences: ::SCOPE:Access Control:IMPACT:Bypass Protection Mechanism:NOTE:An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account.::

Detection Methods: ::METHOD:Dynamic Analysis with Automated Results Interpretation:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Web Application Scanner Web Services Scanner Database Scanners Cost effective for partial coverage: Host-based Vulnerability Scanners - Examine configuration for flaws, verifying that audit mechanisms work, ensure host configuration meets certain predefined criteria:EFFECTIVENESS:High::METHOD:Dynamic Analysis with Manual Results Interpretation:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Fuzz Tester Framework-based Fuzzer Cost effective for partial coverage: Forced Path Execution:EFFECTIVENESS:High::METHOD:Manual Static Analysis - Source Code:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Focused Manual Spotcheck - Focused manual analysis of source Manual Source Code Review (not inspections):EFFECTIVENESS:High::METHOD:Automated Static Analysis - Source Code:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Source code Weakness Analyzer Context-configured Source Code Weakness Analyzer:EFFECTIVENESS:SOAR Partial::METHOD:Automated Static Analysis:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Cost effective for partial coverage: Configuration Checker:EFFECTIVENESS:SOAR Partial::METHOD:Architecture or Design Review:DESCRIPTION:According to SOAR, the following detection techniques may be useful: Highly cost effective: Formal Methods / Correct-By-Construction Cost effective for partial coverage: Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.):EFFECTIVENESS:High::

Potential Mitigations: ::PHASE:Architecture and Design:DESCRIPTION:Common protection mechanisms include: Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.::PHASE:Architecture and Design:STRATEGY:Libraries or Frameworks:DESCRIPTION:Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]::

Observed Examples: ::REFERENCE:CVE-2019-0039:DESCRIPTION:the REST API for a network OS has a high limit for number of connections, allowing brute force password guessing:LINK:https://www.cve.org/CVERecord?id=CVE-2019-0039::REFERENCE:CVE-1999-1152:DESCRIPTION:Product does not disconnect or timeout after multiple failed logins.:LINK:https://www.cve.org/CVERecord?id=CVE-1999-1152::REFERENCE:CVE-2001-1291:DESCRIPTION:Product does not disconnect or timeout after multiple failed logins.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-1291::REFERENCE:CVE-2001-0395:DESCRIPTION:Product does not disconnect or timeout after multiple failed logins.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-0395::REFERENCE:CVE-2001-1339:DESCRIPTION:Product does not disconnect or timeout after multiple failed logins.:LINK:https://www.cve.org/CVERecord?id=CVE-2001-1339::REFERENCE:CVE-2002-0628:DESCRIPTION:Product does not disconnect or timeout after multiple failed logins.:LINK:https://www.cve.org/CVERecord?id=CVE-2002-0628::REFERENCE:CVE-1999-1324:DESCRIPTION:User accounts not disabled when they exceed a threshold; possibly a resultant problem.:LINK:https://www.cve.org/CVERecord?id=CVE-1999-1324::