CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
How it's found
Improper Restriction of Excessive Authentication Attempts is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
Vulnerable vs. safe
printf("Unable to open socket connection");return(FAIL);
isValidUser = AuthenticateUser(username, password);if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {}if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {}int socket = openSocketConnection(host, port);if (socket < 0) {}int isValidUser = 0;char username[USERNAME_SIZE];char password[PASSWORD_SIZE];while (isValidUser == 0) {}return(SUCCESS);int validateUser(char *host, int port){}isValidUser = AuthenticateUser(username, password);if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {}
if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {}count++;
return(SUCCESS);
return(FAIL);...int count = 0;while ((isValidUser == 0) && (count < MAX_ATTEMPTS)) {}if (isValidUser) {}else {}int validateUser(char *host, int port){}Consequences
- Bypass Protection Mechanism: An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account using a brute force attack.
Mitigations
- Architecture and Design: Common protection mechanisms include:Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-307?
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
How do you find Improper Restriction of Excessive Authentication Attempts?
Improper Restriction of Excessive Authentication Attempts is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-307?
Bypass Protection Mechanism: An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account using a brute force attack.
Does TurboPentest test for Improper Restriction of Excessive Authentication Attempts?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
About this reference
These security references are maintained by IntegSec, an offensive-security firm whose team holds CISSP, OSCP, and OSCE certifications and has run thousands of penetration tests. Content is kept current as tools, standards, and attack techniques evolve.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest