Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CWE-602 (服务端安全的客户端实施) — Vulnerability Class 88

88 vulnerabilities classified as CWE-602 (服务端安全的客户端实施). AI Chinese analysis included.

CWE-602 represents a critical architectural flaw where a server improperly delegates security enforcement to the client side. This weakness occurs when developers assume that client-side controls, such as JavaScript validation or UI restrictions, are sufficient to protect sensitive server resources. Attackers typically exploit this by intercepting network traffic or modifying the client application to bypass these checks, allowing them to send unauthorized requests directly to the server. Since the server fails to independently verify the legitimacy of these actions, the attacker can manipulate data, access restricted functions, or cause unexpected system behaviors. To avoid this vulnerability, developers must implement strict server-side validation for all inputs and enforce access controls at the backend. Security mechanisms must never rely on the integrity of the client environment, ensuring that every request is authenticated and authorized regardless of how it was generated.

MITRE CWE Description
The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server. When the server relies on protection mechanisms placed on the client side, an attacker can modify the client-side behavior to bypass the protection mechanisms, resulting in potentially unexpected interactions between the client and server. The consequences will vary, depending on what the mechanisms are trying to protect.
Common Consequences (2)
Access Control, AvailabilityBypass Protection Mechanism, DoS: Crash, Exit, or Restart
Client-side validation checks can be easily bypassed, allowing malformed or unexpected input to pass into the application, potentially as trusted data. This may lead to unexpected states, behaviors and possibly a resulting crash.
Access ControlBypass Protection Mechanism, Gain Privileges or Assume Identity
Client-side checks for authentication can be easily bypassed, allowing clients to escalate their access levels and perform unintended actions.
Mitigations (2)
Architecture and DesignFor any security checks that are performed on the client side, ensure that these checks are duplicated on the server side. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server. Even though client-side checks provide minim…
Architecture and DesignIf some degree of trust is required between the two entities, then use integrity checking and strong authentication to ensure that the inputs are coming from a trusted source. Design the product so that this trust is managed in a centralized fashion, especially if there are complex or numerous communication channels, in order to reduce the risks that the implementer will mistakenly omit a check in…
Examples (2)
This example contains client-side code that checks if the user authenticated successfully before sending a command. The server-side code performs the authentication in one step, and executes the command in a separate step.
$server = "server.example.com"; $username = AskForUserName(); $password = AskForPassword(); $address = AskForAddress(); $sock = OpenSocket($server, 1234); writeSocket($sock, "AUTH $username $password\n"); $resp = readSocket($sock); if ($resp eq "success") { # username/pass is valid, go ahead and update the info! writeSocket($sock, "CHANGE-ADDRESS $username $address\n"; } else { print "ERROR: Invalid Authentication!\n"; }
Good · Perl
$sock = acceptSocket(1234); ($cmd, $args) = ParseClientRequest($sock); if ($cmd eq "AUTH") { ($username, $pass) = split(/\s+/, $args, 2); $result = AuthenticateUser($username, $pass); writeSocket($sock, "$result\n"); # does not close the socket on failure; assumes the # user will try again } elsif ($cmd eq "CHANGE-ADDRESS") { if (validateAddress($args)) { $res = UpdateDatabaseRecord($username, "address", $args); writeSocket($sock, "SUCCESS\n"); } else { writeSocket($sock, "FAILURE -- address is malformed\n"); } }
Bad · Perl
In 2022, the OT:ICEFALL study examined products by 10 different Operational Technology (OT) vendors. The researchers reported 56 vulnerabilities and said that the products were "insecure by design" [REF-1283]. If exploited, these vulnerabilities often allowed adversaries to change how the products operated, ranging from denial of service to changing the code that the products executed. Since these…
CVE IDTitleCVSSSeverityPublished
CVE-2024-32512 WordPress weForms plugin <= 1.6.20 - Form Submission Restriction Bypass vulnerability — weForms 5.3 Medium2024-05-17
CVE-2024-31491 Fortinet FortiSandbox 安全漏洞 — FortiSandbox 8.6 High2024-05-14
CVE-2024-28029 Client-Side Enforcement of Server-Side Security in Delta Electronics DIAEnergie — DIAEnergie 8.8 High2024-03-21
CVE-2024-0701 UserPro <= 5.1.6 - Disabled Membership Registration Bypass — UserPro - Community and User Profile WordPress Plugin 5.3 Medium2024-02-05
CVE-2023-23570 Gallagher Command Centre 安全漏洞 — Command Centre 5.4 Medium2023-12-18
CVE-2023-42787 Fortinet FortiManager 和 FortiAnalyzer 安全漏洞 — FortiManager 6.2 Medium2023-10-10
CVE-2023-3747 Insufficient Validation on Override Codes for Always-Enabled WARP Mode — WARP Client 5.5 Medium2023-09-07
CVE-2023-39218 Zoom Client 安全漏洞 — Zoom Clients 6.1 Medium2023-08-08
CVE-2023-30955 Foundry workspace-server Developer Mode Authorization Bypass — com.palantir.workspace:workspace 4.3 Medium2023-06-29
CVE-2023-20106 Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities — Cisco Identity Services Engine Software 5.4 Medium2023-05-18
CVE-2023-20171 Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities — Cisco Identity Services Engine Software 5.4 Medium2023-05-18
CVE-2023-20172 Cisco Identity Services Engine Arbitrary File Delete and File Read Vulnerabilities — Cisco Identity Services Engine Software 5.4 Medium2023-05-18
CVE-2023-0750 Yellowbrik PEC-1864 authentication bypass — Yellowbrik 9.8 Critical2023-04-06
CVE-2023-0581 PrivateContent <= 8.4.3 - Protection Mechanism Bypass — PrivateContent 5.3 Medium2023-01-30
CVE-2022-1525 Cognex 3D-A1000 Dimensioning System Client-Side Enforcement of Server-Side Security — 3D-A1000 Dimensioning System 9.1 Critical2022-09-06
CVE-2022-31233 Dell EMC Unisphere for PowerMax 安全漏洞 — Unisphere for PowerMax 6.3 Medium2022-08-31
CVE-2021-36338 Dell EMC Unisphere for PowerMax 安全漏洞 — Unisphere for PowerMax 6.3 Medium2022-01-21
CVE-2022-20658 Cisco Unified Contact Center Management Portal and Unified Contact Center Domain Manager Privilege Escalation Vulnerability — Cisco Unified Contact Center Domain Manager 9.6 Critical2022-01-14
CVE-2021-21531 Dell EMC Unisphere for PowerMax 安全漏洞 — Unisphere for PowerMax 8.1 High2021-04-30
CVE-2021-21544 Dell EMC iDRAC9 授权问题漏洞 — Integrated Dell Remote Access Controller (iDRAC) 2.7 Low2021-04-30
CVE-2020-27268 多款Sooil产品授权问题漏洞 — SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A 6.5 -2021-01-19
CVE-2020-24683 Authentication Bypass in Symphony Plus — ABB Ability™ Symphony® Plus Operations 9.8 Critical2020-12-22
CVE-2020-5345 多款Dell产品安全漏洞 — Unisphere for PowerMax 6.4 Medium2020-06-23
CVE-2020-8162 Ruby on Rails 代码问题漏洞 — https://github.com/rails/rails 7.5 -2020-06-19
CVE-2017-12161 Red Hat keycloak 安全漏洞 — Keycloak 8.8 -2018-02-21
CVE-2017-14013 ProMinent MultiFLEX M10a Controller Web界面安全漏洞 — ProMinent MultiFLEX M10a Controller 7.7 -2017-10-17
CVE-2014-2373 Accuenergy Accuenergy Acuvim II Client-Side Enforcement of Server-Side Security — Accuenergy Acuvim II AXN-NET Ethernet module 9.1 -2014-11-05
CVE-2014-2374 Accuenergy Accuenergy Acuvim II Client-Side Enforcement of Server-Side Security — Accuenergy Acuvim II AXN-NET Ethernet module 9.1 -2014-11-05

Vulnerabilities classified as CWE-602 (服务端安全的客户端实施) represent 88 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.