CWE Rule 307

R2026b

Improper Restriction of Excessive Authentication Attempts

Since R2026b

expand all in page

Description

Improper Restriction of Excessive Authentication Attempts

Polyspace Implementation

The rule checker checks for Uncontrolled authentication attempts.

Examples

expand all

Issue

This issue occurs when your code calls an authentication function inside a loop that has no upper bound on the number of iterations.

To use this checker, provide a -code-behavior-specifications file that identifies authentication functions using the AUTHENTICATE_USER behavior type and specifies a maximum call threshold. See Modify Bug Finder Checkers Through Code Behavior Specifications.

If an authentication function is called inside a loop that does not enforce an upper bound on iterations, Polyspace® reports a violation. The threshold value in the specification file determines the maximum number of allowed authentication attempts.

If the option -code-behavior-specifications is not set, the checker is not reported.

Risk

Without a limit on authentication attempts, an attacker can use brute-force techniques to guess valid credentials. Repeated attempts consume system resources and can lock out legitimate users or compromise accounts.

Fix

Bound the loop that calls the authentication function so that it exits after a fixed maximum number of attempts. For example, use a counter variable and compare it to a predefined limit in the loop condition.

Example — Unbounded authentication loop

#include <stdio.h>

#define USERNAME_SIZE 256
#define PASSWORD_SIZE 256
#define FAIL -1
#define SUCCESS 0

int openSocketConnection(char *host, int port);
int getNextMessage(int socket, char *buffer, int size);
int AuthenticateUser(char *username, char *password);

int validateUser(char *host, int port)
{
    int socket = openSocketConnection(host, port);
    if (socket < 0) {
        return FAIL;
    }
    int isValidUser = 0;
    char username[USERNAME_SIZE];
    char password[PASSWORD_SIZE];

    while (isValidUser == 0) {
        if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {
            if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {
                isValidUser = AuthenticateUser(username, password); // Noncompliant
            }
        }
    }
    return SUCCESS;
}

The function validateUser calls AuthenticateUser inside a while loop that continues indefinitely until authentication succeeds. There is no limit on how many times the authentication function can be called, which allows unlimited login attempts. Polyspace reports violations. To detect this issue, specify AuthenticateUser as a function that authenticates a user:

<?xml version="1.0" encoding="UTF-8"?>
<specifications xmlns="http://www.mathworks.com/PolyspaceCodeBehaviorSpecifications">
  <functions>
    <function name="AuthenticateUser">
      <behavior name="AUTHENTICATE_USER" value="5" />
    </function>
  </functions>
</specifications>

Correction — Limit authentication attempts with a counter

To fix this issue, include a loop condition which limits the number of authentication attempts to 5. After this many failed attempts, the function returns FAIL without allowing further tries.


#include <stdio.h>

#define USERNAME_SIZE 256
#define PASSWORD_SIZE 256
#define MAX_ATTEMPTS 5
#define FAIL -1
#define SUCCESS 0

int openSocketConnection(char *host, int port);
int getNextMessage(int socket, char *buffer, int size);
int AuthenticateUser(char *username, char *password);

int validateUser(char *host, int port)
{
    int socket = openSocketConnection(host, port);
    if (socket < 0) {
        return FAIL;
    }
    int isValidUser = 0;
    char username[USERNAME_SIZE];
    char password[PASSWORD_SIZE];
    int count = 0;

    while ((isValidUser == 0) && (count < MAX_ATTEMPTS)) {
        if (getNextMessage(socket, username, USERNAME_SIZE) > 0) {
            if (getNextMessage(socket, password, PASSWORD_SIZE) > 0) {
                isValidUser = AuthenticateUser(username, password); // Compliant
            }
        }
        count++;
    }
    return isValidUser ? SUCCESS : FAIL;
}

Specify the function AuthenticateUser as a function that authenticates a user:

<?xml version="1.0" encoding="UTF-8"?>
<specifications xmlns="http://www.mathworks.com/PolyspaceCodeBehaviorSpecifications">
  <functions>
    <function name="AuthenticateUser">
      <behavior name="AUTHENTICATE_USER" value="5" />
    </function>
  </functions>
</specifications>

Check Information

Category: Others
PQL Name: std.cwe_native.R307

Version History

Introduced in R2026b

See Also

Topics