CWE-799: Improper Control of Interaction Frequency
The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
How it's found
Improper Control of Interaction Frequency describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
This can allow the actor to perform actions more frequently than expected. The actor could be a human or an automated process such as a virus or bot. This could be used to cause a denial of service, compromise program logic (such as limiting humans to a single vote), or other consequences. For example, an authentication routine might not limit the number of times an attacker can guess a password. Or, a web site might conduct a poll but only expect humans to vote a maximum of once a day.
Vulnerable vs. safe
isValidUser = AuthenticateUser(username, password);if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {}if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {}char username[USERNAME_SIZE];char password[PASSWORD_SIZE];while (isValidUser == 0) {}return(SUCCESS);isValidUser = AuthenticateUser(username, password);if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {}
if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {}count++;
return(SUCCESS);
return(FAIL);int count = 0;while ((isValidUser == 0) && (count < MAX_ATTEMPTS)) {}if (isValidUser) {}else {}Consequences
- DoS: Resource Consumption (Other), Bypass Protection Mechanism, Other
How TurboPentest tests for this
TurboPentest tests improper control of interaction frequency (for example missing rate limiting on sensitive flows) during the dynamic pentest, following the OWASP testing guides. Human pentesters add context for abuse cases that depend on business meaning.
Tools: Paladin AI, Web Scanner
Frequently asked questions
What is CWE-799?
The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.
How do you find Improper Control of Interaction Frequency?
Improper Control of Interaction Frequency describes a general pattern rather than a single fixed bug. Testers use a mix of static analysis and manual code review to find where a target's code matches this pattern, then confirm exploitability by hand.
What is the impact of CWE-799?
DoS: Resource Consumption (Other), Bypass Protection Mechanism, Other
Does TurboPentest test for Improper Control of Interaction Frequency?
TurboPentest tests improper control of interaction frequency (for example missing rate limiting on sensitive flows) during the dynamic pentest, following the OWASP testing guides. Human pentesters add context for abuse cases that depend on business meaning.
Related CWEs
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest