CWE-307: Improper Restriction of Excessive Authentication Attempts
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
How it's found
Improper Restriction of Excessive Authentication Attempts is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
Vulnerable vs. safe
printf("Unable to open socket connection");return(FAIL);
isValidUser = AuthenticateUser(username, password);if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {}if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {}int socket = openSocketConnection(host, port);if (socket < 0) {}int isValidUser = 0;char username[USERNAME_SIZE];char password[PASSWORD_SIZE];while (isValidUser == 0) {}return(SUCCESS);int validateUser(char *host, int port){}isValidUser = AuthenticateUser(username, password);if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {}
if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {}count++;
return(SUCCESS);
return(FAIL);...int count = 0;while ((isValidUser == 0) && (count < MAX_ATTEMPTS)) {}if (isValidUser) {}else {}int validateUser(char *host, int port){}Consequences
- Bypass Protection Mechanism: An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account using a brute force attack.
Mitigations
- Architecture and Design: Common protection mechanisms include:Disconnecting the user after a small number of failed attempts Implementing a timeout Locking out a targeted account Requiring a computational task on the user's part.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid [REF-1482]. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-307?
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
How do you find Improper Restriction of Excessive Authentication Attempts?
Improper Restriction of Excessive Authentication Attempts is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-307?
Bypass Protection Mechanism: An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account using a brute force attack.
Does TurboPentest test for Improper Restriction of Excessive Authentication Attempts?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest