Description

CWE-602: Client-Side Enforcement of Server-Side Security

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-13T10:17:15.500Z",
  "pubdate": "2026-08-13T10:17:15.500Z",
  "executiveSummary": "The vulnerability classified as CWE-602 involves the client-side enforcement of server-side security, representing a critical architectural flaw where security-critical checks, validation routines, or access control decisions are improperly delegated to the client application rather than enforced authoritatively on the server side.\nThis architectural deficiency allows malicious actors with full control over the client environment to bypass security controls entirely, manipulate application logic, and compromise sensitive data or execute unauthorized actions.\nThe impact of this vulnerability typically includes unauthorized privilege escalation, data tampering, bypass of authentication or authorization mechanisms, and integrity violations across affected systems and products that rely on client-side trust.\nRisk implications are severe, as attackers require no specialized privileges beyond standard network access and client modification capabilities to alter execution flows.\nExploitation requirements generally involve intercepting, modifying, or simulating client-side communications and execution binaries using standard debugging proxies, reverse engineering tools, or custom scripts to subvert intended security boundaries.",
  "technicalDetails": "The root cause of CWE-602 stems from a fundamental failure in trust boundaries, specifically the erroneous assumption that data, state, or security constraints processed, displayed, or validated within the client-side interface cannot be tampered with by the user.\nThe vulnerable component typically resides in client-side scripts, thick-client applications, mobile apps, or browser-based logic where access control lists, permission checks, data integrity validations, or business logic constraints are evaluated locally before being submitted to backend services.\nBecause the client environment is entirely untrusted and under the adversary's control, attackers can intercept network traffic, manipulate Document Object Model (DOM) states, hook functions, patch binaries, or directly craft malicious HTTP requests that bypass the client-side validation logic altogether.\nThe step-by-step attack flow typically proceeds as follows: First, the attacker analyzes the client-side application using reverse engineering techniques, disassemblers, or web proxy tools such as Burp Suite to identify where security checks are performed.\nSecond, the attacker identifies that the server-side counterpart accepts the client's assertion of security compliance without independently re-verifying the user's privileges, input validity, or state constraints.\nThird, the attacker disables, modifies, or bypasses the client-side validation routine—for instance, by toggling a boolean flag in memory, intercepting a response to elevate user privileges in the UI, or crafting a direct API request that omits the parameter restricting access.\nFinally, the backend server processes the manipulated request, granting unauthorized access to restricted functionalities, administrative interfaces, or sensitive data repositories.\nNetwork exposure varies depending on the product architecture, but web applications and networked thick clients are frequently exposed to remote attackers.\nAuthentication and privilege requirements are often minimal; an unauthenticated or low-privileged attacker can frequently leverage this flaw to perform actions reserved for higher-privileged roles, resulting in severe post-exploitation impact such as complete system compromise, data exfiltration, or unauthorized financial transactions."
}