1425
Consider alternatives to account lockout that would still be effective against password brute
force attacks, such as presenting the user machine with a puzzle to solve (makes it do some
computation).
Demonstrative Examples
Example 1:
A famous example of this type of weakness being exploited is the eBay attack. eBay always
displays the user id of the highest bidder. In the final minutes of the auction, one of the bidders
could try to log in as the highest bidder three times. After three incorrect log in attempts, eBay
password throttling would kick in and lock out the highest bidder's account for some time. An
attacker could then make their own bid and their victim would not have a chance to place the
counter bid because they would be locked out. Thus an attacker could win the auction.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 951 SFP Secondary Cluster: Insecure Authentication Policy 888 2396
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Related Attack Patterns
CAPEC-ID Attack Pattern Name
2 Inducing Account Lockout
CWE-646: Reliance on File Name or Extension of Externally-Supplied File
Weakness ID : 646
Structure : Simple
Abstraction : Variant
Description
The product allows a file to be uploaded, but it relies on the file name or extension of the file
to determine the appropriate behaviors. This could be used by attackers to cause the file to be
misclassified and processed in a dangerous fashion.
Extended Description
An application might use the file name or extension of a user-supplied file to determine the proper
course of action, such as selecting the correct process to which control should be passed, deciding
what data should be made available, or what resources should be allocated. If the attacker can
cause the code to misclassify the supplied file, then the wrong action could occur. For example,
an attacker could supply a file that ends in a ".php.gif" extension that appears to be a GIF image,
but would be processed as PHP code. In extreme cases, code execution is possible, but the
attacker could also cause exhaustion of resources, denial of service, exposure of debug or system
data (including application source code), or being bound to a particular server side process. This
weakness may be due to a vulnerability in any of the technologies used by the web and application
servers, due to misconfiguration, or resultant from another flaw in the application itself.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
CWE Version 4.14
CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions
CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions