8. of Elevation of Privilege
An attacker can enter data that is checked while still under the attacker’s control and used later on the other side of the trust boundary.
|
Threat |
|
|
|
You are validating and/or sanitizing user input on the client side but an attacker can circumvent this using developer tools in the browser, writing their own scripts, or proxying calls to the backend. For example, you validate authentication information to avoid Structured Query Language (SQL) injection but aren’t sanitizing or using parametrized queries on the backend. |
|
CAPEC |
CAPEC-2 – Exploiting trust in the client CAPEC-77 – Manipulating user-controlled variables |
|
ASVS |
1.5.3 – Ensure validation is performed where it can’t be tampered with |
...
