Improper Control of Interaction Frequency

Opis

The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.

This can allow the actor to perform actions more frequently than expected. The actor could be a human or an automated process such as a virus or bot. This could be used to cause a denial of service, compromise program logic (such as limiting humans to a single vote), or other consequences. For example, an authentication routine might not limit the number of times an attacker can guess a password. Or, a web site might conduct a poll but only expect humans to vote a maximum of once a day.

Inne nazwy

Insufficient anti-automation

The term "insufficient anti-automation" focuses primarly on non-human actors such as viruses or bots, but the scope of this CWE entry is broader.

Brute force

Vulnerabilities that can be targeted using brute force attacks are often symptomatic of this weakness.

Skutki

• Availability, Access Control, Other

  DoS: Resource Consumption (Other); Bypass Protection Mechanism; Other

Przykłady podatności

• CVE-2024-50653 Chain: e-commerce product has a "front-end restriction" for coupon use (CWE-602), but the server does not restrict the number of requests for the same coupon (CWE-799)
• CVE-2002-1876 Mail server allows attackers to prevent other users from accessing mail by sending large number of rapid requests.

Słabość nadrzędna

• CWE-691 Insufficient Control Flow Management

Słabości podrzędne

• CWE-307 Improper Restriction of Excessive Authentication Attempts
• CWE-837 Improper Enforcement of a Single, Unique Action

Kiedy powstaje

• Architecture and Design
• Implementation
• Operation

Dotyczy

Not Language-Specific, Not Technology-Specific, Web Based, Web Server

Źródła

1. Insufficient Anti-automation — Web Application Security Consortium