CWE-307 过多认证尝试的限制不恰当
Improper Restriction of Excessive Authentication Attempts
结构: Simple
Abstraction: Base
状态: Draft
被利用可能性: unkown
基本描述
The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.
相关缺陷
-
cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 1000 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 1003 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 287 cwe_View_ID: 699 cwe_Ordinal: Primary
-
cwe_Nature: ChildOf cwe_CWE_ID: 799 cwe_View_ID: 1000
适用平台
Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}
常见的影响
| 范围 | 影响 | 注释 |
|---|---|---|
| Access Control | Bypass Protection Mechanism | An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account. |
检测方法
Dynamic Analysis with Automated Results Interpretation
According to SOAR, the following detection techniques may be useful:
- Web Application Scanner
- Web Services Scanner
- Database Scanners
- Host-based Vulnerability Scanners – Examine configuration for flaws, verifying that audit mechanisms work, ensure host configuration meets certain predefined criteria
Dynamic Analysis with Manual Results Interpretation
According to SOAR, the following detection techniques may be useful:
- Fuzz Tester
- Framework-based Fuzzer
- Forced Path Execution
Manual Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful:
- Focused Manual Spotcheck - Focused manual analysis of source
- Manual Source Code Review (not inspections)
Automated Static Analysis - Source Code
According to SOAR, the following detection techniques may be useful:
- Source code Weakness Analyzer
- Context-configured Source Code Weakness Analyzer
Automated Static Analysis
According to SOAR, the following detection techniques may be useful:
- Configuration Checker
Architecture or Design Review
According to SOAR, the following detection techniques may be useful:
- Formal Methods / Correct-By-Construction
- Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.)
可能的缓解方案
Architecture and Design
策略:
Common protection mechanisms include:
MIT-4 Architecture and Design
策略: Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]
示例代码
例
In January 2009, an attacker was able to gain administrator access to a Twitter server because the server did not restrict the number of login attempts. The attacker targeted a member of Twitter's support team and was able to successfully guess the member's password using a brute force attack by guessing a large number of common words. After gaining access as the member of the support staff, the attacker used the administrator panel to gain access to 33 accounts that belonged to celebrities and politicians. Ultimately, fake Twitter messages were sent that appeared to come from the compromised accounts.
例
The following code, extracted from a servlet's doPost() method, performs an authentication lookup every time the servlet is invoked.
bad Java
String password = request.getParameter("password");
int authResult = authenticateUser(username, password);
However, the software makes no attempt to restrict excessive authentication attempts.
例
This code attempts to limit the number of login attempts by causing the process to sleep before completing the authentication.
bad PHP
$password = $_POST['password'];
sleep(2000);
$isAuthenticated = authenticateUser($username, $password);
However, there is no limit on parallel connections, so this does not increase the amount of time an attacker needs to complete an attack.
例
In the following C/C++ example the validateUser method opens a socket connection, reads a username and password from the socket and attempts to authenticate the username and password.
bad C
{
if (socket printf("Unable to open socket connection");
return(FAIL);
}
int isValidUser = 0;
char username[USERNAME_SIZE];
char password[PASSWORD_SIZE];
while (isValidUser == 0) {
}
}
}
return(SUCCESS);
}文章来源于互联网:scap中文网
- 我的微信
- 微信扫一扫
-
- 我的微信公众号
- 微信扫一扫
-
评论