1. Home
  2. CWE Database
  3. CWE-307
Base · Medium

CWE-307: Improper Restriction of Excessive Authentication Attempts

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

CWE-307 · Base Level ·7 CVEs ·2 Mitigations

Description

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Potential Impact

Access Control

Bypass Protection Mechanism

Demonstrative Examples

The following code, extracted from a servlet's doPost() method, performs an authentication lookup every time the servlet is invoked.
Bad
String username = request.getParameter("username");String password = request.getParameter("password");
                     int authResult = authenticateUser(username, password);
However, the software makes no attempt to restrict excessive authentication attempts.
This code attempts to limit the number of login attempts by causing the process to sleep before completing the authentication.
Bad
$username = $_POST['username'];$password = $_POST['password'];sleep(2000);$isAuthenticated = authenticateUser($username, $password);
However, there is no limit on parallel connections, so this does not increase the amount of time an attacker needs to complete an attack.
In the following C/C++ example the validateUser method opens a socket connection, reads a username and password from the socket and attempts to authenticate the username and password.
Bad
int validateUser(char *host, int port){
                        int socket = openSocketConnection(host, port);if (socket < 0) {printf("Unable to open socket connection");return(FAIL);}
                           int isValidUser = 0;char username[USERNAME_SIZE];char password[PASSWORD_SIZE];
                           while (isValidUser == 0) {
                              if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {isValidUser = AuthenticateUser(username, password);}}
                           }return(SUCCESS);
                     }
The validateUser method will continuously check for a valid username and password without any restriction on the number of authentication attempts made. The method should limit the number of authentication attempts made to prevent brute force attacks as in the following example code.
Good
int validateUser(char *host, int port){
                        ...
                           int count = 0;while ((isValidUser == 0) && (count < MAX_ATTEMPTS)) {
                              if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {isValidUser = AuthenticateUser(username, password);}}count++;
                           }if (isValidUser) {return(SUCCESS);}else {return(FAIL);}
                     }

Mitigations & Prevention

Architecture and Design

Common protection mechanisms include:

Architecture and Design

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

Detection Methods

  • Dynamic Analysis with Automated Results Interpretation High — According to SOAR [REF-1479], the following detection techniques may be useful:
  • Dynamic Analysis with Manual Results Interpretation High — According to SOAR [REF-1479], the following detection techniques may be useful:
  • Manual Static Analysis - Source Code High — According to SOAR [REF-1479], the following detection techniques may be useful:
  • Automated Static Analysis - Source Code SOAR Partial — According to SOAR [REF-1479], the following detection techniques may be useful:
  • Automated Static Analysis SOAR Partial — According to SOAR [REF-1479], the following detection techniques may be useful:
  • Architecture or Design Review High — According to SOAR [REF-1479], the following detection techniques may be useful:

Real-World CVE Examples

CVE IDDescription
CVE-2019-0039the REST API for a network OS has a high limit for number of connections, allowing brute force password guessing
CVE-1999-1152Product does not disconnect or timeout after multiple failed logins.
CVE-2001-1291Product does not disconnect or timeout after multiple failed logins.
CVE-2001-0395Product does not disconnect or timeout after multiple failed logins.
CVE-2001-1339Product does not disconnect or timeout after multiple failed logins.
CVE-2002-0628Product does not disconnect or timeout after multiple failed logins.
CVE-1999-1324User accounts not disabled when they exceed a threshold; possibly a resultant problem.

CWE-1390: Weak Authentication

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does ...

CWE-287: Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is cor...

CWE-799: Improper Control of Interaction Frequency

The product does not properly limit the number or frequency of interactions that it has with an actor, such as the numbe...

Taxonomy Mappings

  • PLOVER: AUTHENT.MULTFAIL — Multiple Failed Authentication Attempts not Prevented
  • Software Fault Patterns: SFP34 — Unrestricted authentication

Frequently Asked Questions

What is CWE-307?

CWE-307 (Improper Restriction of Excessive Authentication Attempts) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

How can CWE-307 be exploited?

Attackers can exploit CWE-307 (Improper Restriction of Excessive Authentication Attempts) to bypass protection mechanism. This weakness is typically introduced during the Architecture and Design phase of software development.

How do I prevent CWE-307?

Key mitigations include: Common protection mechanisms include:

What is the severity of CWE-307?

CWE-307 is classified as a Base-level weakness (Medium abstraction). It has been observed in 7 real-world CVEs.