1. Home
  2. CWE Database
  3. CWE-603
Base · Medium

CWE-603: Use of Client-Side Authentication

A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.

CWE-603 · Base Level ·2 CVEs ·1 Mitigations

Description

A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.

Client-side authentication is extremely weak and may be breached easily. Any attacker may read the source code and reverse-engineer the authentication mechanism to access parts of the application which would otherwise be protected.

Potential Impact

Access Control

Bypass Protection Mechanism, Gain Privileges or Assume Identity

Demonstrative Examples

In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these products were often used in industries such as power, electrical, water, and others, there could even be safety implications.
Multiple vendors used client-side authentication in their OT products.

Mitigations & Prevention

Architecture and Design

Do not rely on client side data. Always perform server side authentication.

Real-World CVE Examples

CVE IDDescription
CVE-2022-33139SCADA system only uses client-side authentication, allowing adversaries to impersonate other users.
CVE-2006-0230Client-side check for a password allows access to a server using crafted XML requests from a modified client.

CWE-1390: Weak Authentication

The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does ...

CWE-602: Client-Side Enforcement of Server-Side Security

The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the s...

CWE-300: Channel Accessible by Non-Endpoint

The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequ...

CWE-656: Reliance on Security Through Obscurity

The product uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algo...

Frequently Asked Questions

What is CWE-603?

CWE-603 (Use of Client-Side Authentication) is a software weakness identified by MITRE's Common Weakness Enumeration. It is classified as a Base-level weakness. A client/server product performs authentication within client code but not in server code, allowing server-side authentication to be bypassed via a modified client that omits the authentication check.

How can CWE-603 be exploited?

Attackers can exploit CWE-603 (Use of Client-Side Authentication) to bypass protection mechanism, gain privileges or assume identity. This weakness is typically introduced during the Architecture and Design, Implementation phase of software development.

How do I prevent CWE-603?

Key mitigations include: Do not rely on client side data. Always perform server side authentication.

What is the severity of CWE-603?

CWE-603 is classified as a Base-level weakness (Medium abstraction). It has been observed in 2 real-world CVEs.