CWE-408 covers products that let an entity perform a legitimate but expensive operation before authentication or authorization has happened. The operation itself is allowed. The order is the bug.
How it happens
A request arrives, and the code starts working on it right away: allocating memory, building a directory, parsing a large body, running a query. The identity check comes later, or never gates the costly part.
MITRE's observed example is a tool that created directories before authenticating the user (CVE-2004-2458). An anonymous caller could trigger real work on the server without ever logging in.
What an attacker gains
The consequence is availability. System resources, CPU and memory, can be consumed quickly, which can lead to poor performance or a crash. The attacker does not need an account, and each request costs them far less than it costs you.
How to find it
The record lists no detection methods, so use these checks:
- Trace a request from the socket to the first line that checks identity. List everything that runs before that line.
- Send unauthenticated requests with large bodies or heavy parameters and watch server resource use.
- Review code that allocates or writes to disk early in a handler.
How to fix it
- Authenticate and authorize first, then do the expensive work.
- Keep the pre-authentication path cheap. Limit body size, header count and connection time.
- Rate limit unauthenticated callers by address.
- Defer allocation until the request is known to be legitimate.
A simple mental model
Imagine a front desk that makes a custom badge for every visitor before checking their name. Anyone can walk in and keep the badge printer busy. Moving the identity check to the start costs almost nothing and removes the attack. In software terms, the cheapest checks should run first and the costliest work should run last.
Quick check
Is this the same as a denial of service flood?
Not quite. A flood overwhelms with volume. Early amplification lets a small number of requests do outsized work because the expensive step runs before the access check.
