CWE-307 过多认证尝试的限制不恰当

Improper Restriction of Excessive Authentication Attempts

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown

基本描述

The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.

相关缺陷

  • cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 1003 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 699 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 799 cwe_View_ID: 1000

适用平台

Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}

常见的影响

范围 影响 注释
Access Control Bypass Protection Mechanism An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account.

检测方法

Dynamic Analysis with Automated Results Interpretation

According to SOAR, the following detection techniques may be useful:

Highly cost effective:
  • Web Application Scanner
  • Web Services Scanner
  • Database Scanners
Cost effective for partial coverage:
  • Host-based Vulnerability Scanners – Examine configuration for flaws, verifying that audit mechanisms work, ensure host configuration meets certain predefined criteria

Dynamic Analysis with Manual Results Interpretation

According to SOAR, the following detection techniques may be useful:

Highly cost effective:
  • Fuzz Tester
  • Framework-based Fuzzer
Cost effective for partial coverage:
  • Forced Path Execution

Manual Static Analysis - Source Code

According to SOAR, the following detection techniques may be useful:

Highly cost effective:
  • Focused Manual Spotcheck - Focused manual analysis of source
  • Manual Source Code Review (not inspections)

Automated Static Analysis - Source Code

According to SOAR, the following detection techniques may be useful:

Cost effective for partial coverage:
  • Source code Weakness Analyzer
  • Context-configured Source Code Weakness Analyzer

Automated Static Analysis

According to SOAR, the following detection techniques may be useful:

Cost effective for partial coverage:
  • Configuration Checker

Architecture or Design Review

According to SOAR, the following detection techniques may be useful:

Highly cost effective:
  • Formal Methods / Correct-By-Construction
Cost effective for partial coverage:
  • Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)

可能的缓解方案

Architecture and Design

策略: Common protection mechanisms include:

MIT-4 Architecture and Design

策略: Libraries or Frameworks

Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]

示例代码

例

In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support staff, the attacker used the administrator panel to gain access to 33 accounts that belonged to celebrities and politicians. Ultimately, fake Twitter messages were sent that appeared to come from the compromised accounts.

例

The following code, extracted from a servlet's doPost() method, performs an authentication lookup every time the servlet is invoked.

bad Java

String username = request.getParameter("username");
String password = request.getParameter("password");

int authResult = authenticateUser(username, password);

However, the software makes no attempt to restrict excessive authentication attempts.

例

This code attempts to limit the number of login attempts by causing the process to sleep before completing the authentication.

bad PHP

$username = $_POST['username'];
$password = $_POST['password'];
sleep(2000);
$isAuthenticated = authenticateUser($username, $password);

However, there is no limit on parallel connections, so this does not increase the amount of time an attacker needs to complete an attack.

例

In the following C/C++ example the validateUser method opens a socket connection, reads a username and password from the socket and attempts to authenticate the username and password.

bad C

int validateUser(char *host, int port)
{
int socket = openSocketConnection(host, port);
if (socket < 0) {
printf("Unable to open socket connection");
return(FAIL);
}

int isValidUser = 0;
char username[USERNAME_SIZE];
char password[PASSWORD_SIZE];

while (isValidUser == 0) {
if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {
if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {
isValidUser = AuthenticateUser(username, password);
}
}
}
return(SUCCESS);
}

The validateUser method will continuously check for a valid username and password without any restriction on the number of authentication attempts made. The method should limit the number of authentication attempts made to prevent brute force attacks as in the following example code.

good C

int validateUser(char *host, int port)
{
...

int count = 0;
while ((isValidUser == 0) && (count < MAX_ATTEMPTS)) {
if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {
if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {
isValidUser = AuthenticateUser(username, password);
}
}
count++;
}
if (isValidUser) {
return(SUCCESS);
}
else {
return(FAIL);
}
}

分析过的案例

标识 说明 链接
CVE-1999-1152 Product does not disconnect or timeout after multiple failed logins. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-1152
CVE-2001-1291 Product does not disconnect or timeout after multiple failed logins. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1291
CVE-2001-0395 Product does not disconnect or timeout after multiple failed logins. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-0395
CVE-2001-1339 Product does not disconnect or timeout after multiple failed logins. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2001-1339
CVE-2002-0628 Product does not disconnect or timeout after multiple failed logins. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0628
CVE-1999-1324 User accounts not disabled when they exceed a threshold; possibly a resultant problem. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-1999-1324

分类映射

映射的分类名 ImNode ID Fit Mapped Node Name
PLOVER AUTHENT.MULTFAIL Multiple Failed Authentication Attempts not Prevented
Software Fault Patterns SFP34 Unrestricted authentication

引用