CME-906

Rate Limiting / Connection Throttling

Harden Application Unquantified evidence Preventive

Description

Limits request rate per client IP or authenticated identity. Mitigates brute force attacks, credential stuffing, and application-level denial of service from single-source attackers. Does not protect against distributed attacks across many source IPs.

CVSS Vector Impacts

Metric	Transition	Rationale
Availability (A)	H → L	Per-IP request throttling caps the rate at which any single source can consume application resources (connections, threads, CPU), preventing single-source request flooding from exhausting capacity for other clients
Attack Complexity (AC)	L → H	Per-IP throttling limits authentication attempts to a rate that makes dictionary and brute force attacks from a single source impractical (e.g., 5 attempts/minute vs thousands/second)

CWE Relationships

CWE-307 CWE-400 CWE-799

Verification

Verify rate limiting is configured in the web server or reverse proxy

$ grep -r 'limit_req_zone' /etc/nginx/ 2>/dev/null
# Expected: limit_req_zone

Platform: linux

$ grep -rE 'mod_ratelimit|mod_evasive' /etc/httpd/conf*/ /etc/apache2/ 2>/dev/null
# Expected: mod_ratelimit

Platform: linux

$ Get-WebConfigurationProperty -Filter 'system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests' -PSPath 'IIS:\Sites\Default Web Site' -Name enabled
# Expected: True

Platform: windows

Remediation

linux nginx rate limiting with limit_req_zone


printf 'limit_req_zone $binary_remote_addr zone=cme906:10m rate=10r/s;\n' > /etc/nginx/conf.d/rate-limit.conf
sed -i '/location \//a \    limit_req zone=cme906 burst=20 nodelay;' /etc/nginx/conf.d/<server_conf>
nginx -t
systemctl reload nginx

linux Apache httpd rate limiting with mod_evasive


dnf install -y mod_evasive || apt-get install -y libapache2-mod-evasive
printf '<IfModule mod_evasive24.c>\n  DOSHashTableSize 3097\n  DOSPageCount 50\n  DOSSiteCount 100\n  DOSPageInterval 1\n  DOSSiteInterval 1\n  DOSBlockingPeriod 10\n</IfModule>\n' > /etc/httpd/conf.d/mod_evasive.conf
systemctl reload httpd || systemctl reload apache2

windows IIS Dynamic IP Restrictions


Install-WindowsFeature Web-IP-Security
Set-WebConfigurationProperty -Filter 'system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests' -PSPath 'IIS:\Sites\Default Web Site' -Name enabled -Value $true; Set-WebConfigurationProperty -Filter 'system.webServer/security/dynamicIpSecurity/denyByConcurrentRequests' -PSPath 'IIS:\Sites\Default Web Site' -Name maxConcurrentRequests -Value 10
Set-WebConfigurationProperty -Filter 'system.webServer/security/dynamicIpSecurity/denyByRequestRate' -PSPath 'IIS:\Sites\Default Web Site' -Name enabled -Value $true; Set-WebConfigurationProperty -Filter 'system.webServer/security/dynamicIpSecurity/denyByRequestRate' -PSPath 'IIS:\Sites\Default Web Site' -Name maxRequests -Value 25; Set-WebConfigurationProperty -Filter 'system.webServer/security/dynamicIpSecurity/denyByRequestRate' -PSPath 'IIS:\Sites\Default Web Site' -Name requestIntervalInMilliseconds -Value 10000