CWE
Home > CWE List > CWE- Individual Dictionary Definition (1.0)  
Search by ID:

CWE-603: Use of Client-Side Authentication

Individual Definition in a New Window
Use of Client-Side Authentication
Status: Draft
Weakness ID: 603 (Weakness Base)
Description
Summary

A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.

Extended Description

Client-side authentication is extremely weak and may be breached easily. Any attacker may read the source code and reverse-engineer the authentication mechanism to access parts of the application which would otherwise be protected.

Potential Mitigations

Do not rely on client side data. Always perform server side authentication.

Observed Examples
ReferenceDescription
Client-side check for a password allows access to a server using crafted XML requests from a modified client.
Other Notes

Note that there is a close relationship between this weakness and CWE-656 (Reliance on Security through Obscurity). If developers do not believe that a user can reverse engineer a client, then they are more likely to choose client-side authentication in the belief that it is safe.

Relationships
NatureTypeIDNameView(s) this relationship pertains toView(s)
ChildOfWeakness BaseWeakness BaseWeakness Base602Design Principle Violation: Client-Side Enforcement of Server-Side Security
Research Concepts (primary)1000
PeerOfWeakness ClassWeakness ClassWeakness Class592Authentication Bypass Issues
Research Concepts1000
ChildOfWeakness ClassWeakness ClassWeakness Class287Insufficient Authentication
Development Concepts (primary)699
Research Concepts1000
PeerOfWeakness ClassWeakness ClassWeakness Class300Channel Accessible by Non-Endpoint (aka 'Man-in-the-Middle')
Research Concepts1000
Taxonomy Mappings
Mapped Taxonomy Name
Anonymous Tool Vendor (under NDA)
Time of Introduction
* Architecture and Design
* Implementation
Content History
Submissions
Anonymous Tool Vendor (under NDA). (Externally Mined)
Modifications
Eric Dalci. Cigital. 2008-07-01. (External)
updated Potential_Mitigations, Time_of_Introduction
CWE Content Team. MITRE. 2008-09-08. (Internal)
updated Description, Relationships, Observed_Example, Other_Notes, Taxonomy_Mappings
Previous Entry Names
* Client-Side Authentication (changed 2008-04-11)
Back to top
Page Last Updated: September 10, 2008
 

CWE is a Software Assurance strategic initiative sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

This Web site is hosted by The MITRE Corporation.
Copyright 2008, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation.

Contact cwe@mitre.org for more information.
Privacy policy
Terms of use
Contact us