이름: Use of Client-Side Authentication

A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.

일반 정보

취약점 도입 방식

Architecture and Design : COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.
Implementation

적용 가능한 플랫폼

언어

클래스: Not Language-Specific (Undetermined)

기술

클래스: ICS/OT (Undetermined)

일반적인 결과

범위	영향	가능성
Access Control	Bypass Protection Mechanism, Gain Privileges or Assume Identity 참고: Client-side authentication is extremely weak and may be breached easily. An attacker may read the source code or otherwise reverse-engineer the authentication mechanism, then modify the client or otherwise to access parts of the application that would otherwise be protected.

관찰된 예시

참고 자료	설명
CVE-2022-33139	SCADA system only uses client-side authentication, allowing adversaries to impersonate other users.
CVE-2006-0230	Client-side check for a password allows access to a server using crafted XML requests from a modified client.

잠재적 완화 방법

Phases : Architecture and Design
Do not rely on client side data. Always perform server side authentication.

취약점 매핑 메모

근거 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
댓글 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

참고 자료

REF-62

The Art of Software Security Assessment
Mark Dowd, John McDonald, Justin Schuh.

REF-1283

OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management
Forescout Vedere Labs.
https://www.forescout.com/resources/ot-icefall-report/

제출

이름	조직	날짜	출시일	Version
Anonymous Tool Vendor (under NDA)		2007-05-07 +00:00	2007-05-07 +00:00	Draft 6

수정 사항

이름	조직	날짜	댓글
Eric Dalci	Cigital	2008-07-01 +00:00	updated Potential_Mitigations, Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Description, Relationships, Observed_Example, Other_Notes, Taxonomy_Mappings
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences, Maintenance_Notes, Other_Notes
CWE Content Team	MITRE	2012-05-11 +00:00	updated References, Relationships
CWE Content Team	MITRE	2012-10-30 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-05-03 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Modes_of_Introduction, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2021-03-15 +00:00	updated Maintenance_Notes, Relationships
CWE Content Team	MITRE	2022-10-13 +00:00	updated Demonstrative_Examples, Observed_Examples, References, Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Applicable_Platforms, Relationships
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes, Relationships
CWE Content Team	MITRE	2025-12-11 +00:00	updated Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Description

CWE-603 상세 정보

CWE-603