CWE-799: Improper Control of Interaction Frequency

How it's found

Improper Control of Interaction Frequency describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.

This can allow the actor to perform actions more frequently than expected. The actor could be a human or an automated process such as a virus or bot. This could be used to cause a denial of service, compromise program logic (such as limiting humans to a single vote), or other consequences. For example, an authentication routine might not limit the number of times an attacker can guess a password. Or, a web site might conduct a poll but only expect humans to vote a maximum of once a day.

Vulnerable vs. safe

isValidUser = AuthenticateUser(username, password);if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {}if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {}char username[USERNAME_SIZE];char password[PASSWORD_SIZE];while (isValidUser == 0) {}return(SUCCESS);

isValidUser = AuthenticateUser(username, password);if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {}
if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {}count++;

return(SUCCESS);

return(FAIL);int count = 0;while ((isValidUser == 0) && (count < MAX_ATTEMPTS)) {}if (isValidUser) {}else {}

Consequences

• DoS: Resource Consumption (Other), Bypass Protection Mechanism, Other

Where this fits in a TurboPentest engagement

This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.

Frequently asked questions

Related CWEs

• Pillar weakness
  CWE-691: Insufficient Control Flow Management