CWE-645, Overly Restrictive Account Lockout Mechanism, describes a lockout feature that fires too easily. The control meant to stop brute force becomes a denial of service tool against any account whose name an attacker knows.
How it happens
Lockout disables an account after a number of failed logins, for a time or until an administrator steps in. If the threshold is low and applies to the login name alone, anyone can fail a victim's login a few times and keep it locked. The attacker needs no password, only a username.
# Naive: counts failures per username only
if failed_logins[username] >= 3:
lock(username) # attacker can trigger this for anyone
What an attacker gains
Availability impact: users could be locked out of accounts. Run the attack in a loop and legitimate users never get in.
How to find it
The record lists no detection methods. Test your own login: try a handful of wrong passwords against a test account from a different machine and see whether the real user is blocked, and for how long.
How to fix it
MITRE suggests:
- Use smarter throttling that takes IP address into account in addition to the login name.
- Use a lockout timeout that grows as incorrect attempts go up, eventually resulting in a complete lockout.
- Consider alternatives that still stop brute force, such as presenting the user's machine with a puzzle to solve so it must do some computation.
Quick check
Why is counting failures by username alone risky?
Anyone who knows a username can trigger the lockout for that user, with no password needed.
