Summary

The system must enforce access controls on trusted enforcement points, which are not on the client's side.

Description

Systems must enforce access controls on trusted enforcement points, such as access control gateways, servers and serverless functions. Client-side access control enforcement cannot be trusted because it is prone to being bypassed and/or tampered with.

References

• CAPEC-11. Cause web server misclassification
• CAPEC-22. Exploiting trust in client
• CAPEC-28. Fuzzing
• CAPEC-34. HTTP response splitting
• CAPEC-39. Manipulating opaque client-based data tokens
• CAPEC-153. Input data manipulation
• CAPEC-690. Metadata Spoofing
• CWE-284. Improper access control
• CWE-285. Improper authorization
• CWE-290. Authentication bypass by spoofing
• CWE-602. Client-side enforcement of server-side security
• CWE-639. Authorization bypass through user-controlled key
• EPRIVACY-4_1a. Security of processing
• OWASP10-A1. Broken access control
• OWASP10-A2. Cryptographic failures
• OWASPM10-M1. Improper platform usage
• AGILE-11. Best architectures, requirements, and designs
• CERTJ-LCK11-J. Avoid client-side locking when using classes that do not commit to their locking strategy
• MITRE-M1035. Limit access to resource over network
• PADSS-5_2_8. Improper access controls
• CMMC-AC_L2-3_1_14. Remote access routing
• CMMC-CM_L2-3_4_9. User-installed software
• HITRUST-01_o. Network routing control
• WASSEC-6_2_5_3. Information disclosure - Path traversal
• OSSTMM3-9_4_1. Wireless security (visibility audit) - Interception
• WASC-A_12. Content spoofing
• WASC-A_33. Path traversal
• WASC-W_17. Improper filesystem permissions
• WASC-W_02. Insufficient authorization
• ISSAF-F_5_9. Network security - Router security assessment (configure ingress filtering)
• ISSAF-G_15. Network security - Firewalls (compromise remote users/sites)
• ISSAF-P_6_15. Host security - Linux security (local attacks)
• ISSAF-T_16_1. Web application assessment - Input validation (validate data)
• PTES-6_2_3. Exploitation - Countermeasures (data execution prevention)
• OWASPSCP-8. Data protection
• CWE25-22. Improper limitation of a pathname to a restricted directory (path traversal)
• NIST800115-3_6. File integrity checking
• ASVS-1_4_1. Access control architecture
• ASVS-8_1_3. General data protection
• ASVS-12_3_1. File execution
• SIGLITE-SL_131. Are end user devices used for transmitting, processing or storing scoped data?
• CWE-15. External control of system or configuration setting
• CWE-22. Improper limitation of a pathname to a restricted directory ("path traversal")
• CWE-36. Absolute path traversal
• CWE-73. External control of file name or path
• ASVS-5_1_4. Input validation
• ASVS-5_2_1. Sanitization and sandboxing
• ASVS-5_2_2. Sanitization and sandboxing
• ASVS-5_2_3. Sanitization and sandboxing
• ASVS-5_2_7. Sanitization and sandboxing
• ASVS-5_3_6. Output encoding and injection prevention
• ASVS-5_4_2. Memory, string, and unmanaged code
• ASVS-14_5_1. HTTP request header validation
• OWASPAPI-API4. Lack of Resources & Rate Limiting
• OWASPAPI-API5. Broken Function Level Authorization
• CASA-1_4_1. Access Control Architecture
• CASA-5_1_4. Input Validation
• CASA-5_2_3. Sanitization and Sandboxing
• CASA-5_2_7. Sanitization and Sandboxing
• CASA-5_3_6. Output Encoding and Injection Prevention
• CASA-8_1_3. General Data Protection
• CASA-13_1_4. Generic Web Service Security
• SANS25-8. Improper limitation of a pathname to a restricted directory (path traversal)
• OWASPLLM-LLM01:2025. Prompt Injection
• OWASPLLM-LLM08:2025. Vector and Embedding Weaknesses

Weaknesses

• 032. Spoofing
• 039. Improper authorization control for web services
• 063. Lack of data validation - Path Traversal
• 064. Traceability loss - Server's clock
• 075. Unauthorized access to files - APK Content Provider
• 089. Lack of data validation - Trust boundary violation
• 093. Hidden fields manipulation
• 098. External control of file name or path
• 103. Insufficient data authenticity validation - APK signing
• 127. Lack of data validation - Type confusion
• 184. Lack of data validation
• 185. Lack of data validation - Header x-amzn-RequestId
• 186. Lack of data validation - Web Service
• 187. Lack of data validation - Source Code
• 188. Lack of data validation - Modify DOM Elements
• 189. Lack of data validation - Content Spoofing
• 190. Lack of data validation - Session Cookie
• 191. Lack of data validation - Responses
• 192. Lack of data validation - Reflected Parameters
• 193. Lack of data validation - Host Header Injection
• 194. Lack of data validation - Input Length
• 195. Lack of data validation - Headers
• 196. Lack of data validation - Dates
• 197. Lack of data validation - Numbers
• 198. Lack of data validation - Out of range
• 199. Lack of data validation - Emails
• 200. Traceability loss
• 201. Unauthorized access to files
• 202. Unauthorized access to files - Debug APK
• 203. Unauthorized access to files - Cloud Storage Services
• 204. Insufficient data authenticity validation
• 274. Restricted fields manipulation
• 321. Lack of data validation - HTML code
• 327. Insufficient data authenticity validation - Images
• 340. Lack of data validation - Special Characters
• 341. Lack of data validation - OTP
• 344. Lack of data validation - Non Sanitized Variables
• 353. Lack of data validation - Token
• 355. Insufficient data authenticity validation - Checksum verification
• 377. Insufficient data authenticity validation - Device Binding
• 382. Insufficient data authenticity validation - Front bypass
• 389. Insufficient data authenticity validation - JAR signing
• 452. Prompt injection