1353
Example Language: (Bad)
$sock = acceptSocket(1234);
($cmd, $args) = ParseClientRequest($sock);
if ($cmd eq "AUTH") {
($username, $pass) = split(/\s+/, $args, 2);
$result = AuthenticateUser($username, $pass);
writeSocket($sock, "$result\n");
# does not close the socket on failure; assumes the
# user will try again
}
elsif ($cmd eq "CHANGE-ADDRESS") {
if (validateAddress($args)) {
$res = UpdateDatabaseRecord($username, "address", $args);
writeSocket($sock, "SUCCESS\n");
}
else {
writeSocket($sock, "FAILURE -- address is malformed\n");
}
}
The server accepts 2 commands, "AUTH" which authenticates the user, and "CHANGEADDRESS"
which updates the address field for the username. The client performs the
authentication and only sends a CHANGE-ADDRESS for that user if the authentication succeeds.
Because the client has already performed the authentication, the server assumes that the
username in the CHANGE-ADDRESS is the same as the authenticated user. An attacker could
modify the client by removing the code that sends the "AUTH" command and simply executing the
CHANGE-ADDRESS.
Example 2:
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT)
vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by
design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the
products operated, ranging from denial of service to changing the code that the products executed.
Since these products were often used in industries such as power, electrical, water, and others,
there could even be safety implications.
Multiple vendors used client-side authentication in their OT products.
Observed Examples
Reference Description
CVE-2022-33139 SCADA system only uses client-side authentication, allowing adversaries to
impersonate other users.
https://www.cve.org/CVERecord?id=CVE-2022-33139
CVE-2006-6994 ASP program allows upload of .asp files by bypassing client-side checks.
https://www.cve.org/CVERecord?id=CVE-2006-6994
CVE-2007-0163 steganography products embed password information in the carrier file, which
can be extracted from a modified client.
https://www.cve.org/CVERecord?id=CVE-2007-0163
CVE-2007-0164 steganography products embed password information in the carrier file, which
can be extracted from a modified client.
https://www.cve.org/CVERecord?id=CVE-2007-0164
CVE-2007-0100 client allows server to modify client's configuration and overwrite arbitrary files.
https://www.cve.org/CVERecord?id=CVE-2007-0100
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
CWE Version 4.14
CWE-603: Use of Client-Side Authentication
CWE-603: Use of Client-Side Authentication