ASP.NET Identity account lockout disabled or weakened

ID

vbnet.authentication.misconfigured_account_lockout

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Authentication

Language

VB.NET

Description

ASP.NET Identity account lockout is disabled or weakened: AllowedForNewUsers is set to False or MaxFailedAccessAttempts is set to a very high value. This lets an attacker run brute-force credential attacks unchecked. Enable lockout (AllowedForNewUsers = True) and keep MaxFailedAccessAttempts low (for example 5).

Rationale

ASP.NET Identity account lockout is disabled or weakened: AllowedForNewUsers is set to False or MaxFailedAccessAttempts is set to a very high value. This lets an attacker run brute-force credential attacks unchecked. Enable lockout (AllowedForNewUsers = True) and keep MaxFailedAccessAttempts low (for example 5).

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub DisableLockoutForNewUsers(options As IdentityOptions)
    ' VULNERABLE: ASP.NET Identity account lockout disabled or weakened
    options.Lockout.AllowedForNewUsers = False
End Sub

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References