CWE-307: Improper Restriction of Excessive Authentication Attempts

Description:
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Affected languages: Not Language-Specific
Parent weaknesses: CWE-1390, CWE-287, CWE-799

Consequences:
  - Access Control: Bypass Protection Mechanism

Detection methods:
  - Dynamic Analysis with Automated Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           
  - Dynamic Analysis with Manual Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           
  - Manual Static Analysis - Source Code: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Highly cost effective: 
                         
                           
  - Automated Static Analysis - Source Code: According to SOAR [REF-1479], the following detection techniques may be useful: 
                   
                      Cost effective for partial coverage: 
                         
             

Mitigations:
  - [Architecture and Design] Common protection mechanisms include: 
                      
                         Disconnecting the user after a small number of failed attempts 
                         Implementing a timeout 
                         Locking out a targeted account 
                         Requiring a comput
  - [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. 
                   Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

Demonstrative examples:
In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts [REF-236]. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support staff, the attacker used the administrator panel to gain access to 33 accounts that belonged to celebrities and politicians. Ultimately, fake Twitter messages were sent that appeared to come from the compromised accounts.

The following code, extracted from a servlet's doPost() method, performs an authentication lookup every time the servlet is invoked.
However, the software makes no attempt to restrict excessive authentication attempts.
String username = request.getParameter("username"); String [CREDENTIAL_REDACTED].getParameter("password"); 
                      int authResult = authenticateUser(username, password);

Real-world examples:
  - CVE-2019-0039: the REST API for a network OS has a high limit for number of connections, allowing brute force password guessing
  - CVE-1999-1152: Product does not disconnect or timeout after multiple failed logins.
  - CVE-2001-1291: Product does not disconnect or timeout after multiple failed logins.
  - CVE-2001-0395: Product does not disconnect or timeout after multiple failed logins.
  - CVE-2001-1339: Product does not disconnect or timeout after multiple failed logins.