CVE-2020-29042 - Improper Restriction of Excessive Authentication Attempts

Severity

37%

Complexity

22%

Confidentiality

23%

An issue was discovered in BigBlueButton through 2.2.29. A brute-force attack may occur because an unlimited number of codes can be entered for a meeting that is protected by an access code.

CVSS 3.1 Base Score 3.7. CVSS Attack Vector: network. CVSS Attack Complexity: high. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS 2.0 Base Score 4.3. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:P/I:N/A:N).

Demo Examples

Improper Restriction of Excessive Authentication Attempts

CWE-307

Improper Restriction of Excessive Authentication Attempts

CWE-307

The following code, extracted from a servlet's doPost() method, performs an authentication lookup every time the servlet is invoked.


               
int authResult = authenticateUser(username, password);

However, the software makes no attempt to restrict excessive authentication attempts.

Improper Restriction of Excessive Authentication Attempts

CWE-307

This code attempts to limit the number of login attempts by causing the process to sleep before completing the authentication.


               
$isAuthenticated = authenticateUser($username, $password);

However, there is no limit on parallel connections, so this does not increase the amount of time an attacker needs to complete an attack.

Improper Restriction of Excessive Authentication Attempts

CWE-307

In the following C/C++ example the validateUser method opens a socket connection, reads a username and password from the socket and attempts to authenticate the username and password.


               
}
return(SUCCESS);
return(FAIL);
}
}
isValidUser = AuthenticateUser(username, password);

The validateUser method will continuously check for a valid username and password without any restriction on the number of authentication attempts made. The method should limit the number of authentication attempts made to prevent brute force attacks as in the following example code.


               
}
}
count++;
}
isValidUser = AuthenticateUser(username, password);
return(SUCCESS);
return(FAIL);

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.