Use of Client-Side Authentication

Opis

A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.

Client-side authentication is extremely weak and may be breached easily. Any attacker may read the source code and reverse-engineer the authentication mechanism to access parts of the application which would otherwise be protected.

Skutki

• Access Control

  Bypass Protection Mechanism; Gain Privileges or Assume Identity

Zapobieganie

• Architecture and Design

  Do not rely on client side data. Always perform server side authentication.

Przykłady podatności

• CVE-2022-33139 SCADA system only uses client-side authentication, allowing adversaries to impersonate other users.
• CVE-2006-0230 Client-side check for a password allows access to a server using crafted XML requests from a modified client.

Słabość nadrzędna

• CWE-1390 Weak Authentication
• CWE-602 Client-Side Enforcement of Server-Side Security

Pokrewna

• CWE-300 Channel Accessible by Non-Endpoint
• CWE-656 Reliance on Security Through Obscurity

Kiedy powstaje

• Architecture and Design — COMMISSION: This weakness refers to an incorrect design related to an architectural security tactic.
• Implementation

Dotyczy

Not Language-Specific, ICS/OT

Źródła

1. The Art of Software Security Assessment — Mark Dowd, John McDonald, Justin Schuh, Chapter 2, "Untrustworthy Credentials", Page 37, Addison Wesley, 2006
2. OT:ICEFALL: The legacy of "insecure by design" and its implications for certifications and risk management — Forescout Vedere Labs, 2022