Improper Restriction of Excessive Authentication Attempts

Opis

The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.

Skutki

• Access Control

  Bypass Protection Mechanism

  An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account using a brute force attack.

Zapobieganie

• Architecture and Design

  Common protection mechanisms include:

  - Disconnecting the user after a small number of failed attempts

  - Implementing a timeout

  - Locking out a targeted account

  - Requiring a computational task on the user's part.

• Architecture and Design · Libraries or Frameworks

  Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482].

  Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

Przykłady podatności

• CVE-2019-0039 the REST API for a network OS has a high limit for number of connections, allowing brute force password guessing
• CVE-1999-1152 Product does not disconnect or timeout after multiple failed logins.
• CVE-2001-1291 Product does not disconnect or timeout after multiple failed logins.
• CVE-2001-0395 Product does not disconnect or timeout after multiple failed logins.
• CVE-2001-1339 Product does not disconnect or timeout after multiple failed logins.
• CVE-2002-0628 Product does not disconnect or timeout after multiple failed logins.
• CVE-1999-1324 User accounts not disabled when they exceed a threshold; possibly a resultant problem.

Słabość nadrzędna

• CWE-1390 Weak Authentication
• CWE-287 Improper Authentication
• CWE-799 Improper Control of Interaction Frequency

Kiedy powstaje

• Architecture and Design — COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.

Dotyczy

Not Language-Specific

Źródła

1. OWASP Enterprise Security API (ESAPI) Project — OWASP
2. Weak Password Brings 'Happiness' to Twitter Hacker — Kim Zetter, 2009
3. This Black Box Can Brute Force Crack iPhone PIN Passcodes — Graham Cluley, The Mac Security Blog, 2015