CWE-206: Observable Internal Behavioral Discrepancy

Variant Incomplete Simple

CWE版本: 4.18

更新日期: 2025-09-09

弱点描述

The product performs multiple behaviors that are combined to produce a single result, but the individual behaviors are observable separately in a way that allows attackers to reveal internal state or internal decision points.

扩展描述

Ideally, a product should provide as little information as possible to an attacker. Any hints that the attacker may be making progress can then be used to simplify or optimize the attack. For example, in a login procedure that requires a username and password, ultimately there is only one decision: success or failure. However, internally, two separate actions are performed: determining if the username exists, and checking if the password is correct. If the product behaves differently based on whether the username exists or not, then the attacker only needs to concentrate on the password.

常见后果

影响范围: Confidentiality Access Control

技术影响: Read Application Data Bypass Protection Mechanism

潜在缓解措施

描述: Setup generic response pages for error conditions. The error page should not disclose information about the success or failure of a sensitive operation. For instance, the login page should not confirm that the login is correct and the password incorrect. The attacker who tries random account name may be able to guess some of them. Confirming that the account exists would make the login page more susceptible to brute force attack.

观察示例

参考: CVE-2002-2031

File existence via infoleak monitoring whether "onerror" handler fires or not.

参考: CVE-2005-2025

Valid groupname enumeration via behavioral infoleak (sends response if valid, doesn't respond if not).

参考: CVE-2001-1497

Behavioral infoleak in GUI allows attackers to distinguish between alphanumeric and non-alphanumeric characters in a password, thus reducing the search space.

参考: CVE-2003-0190

Product immediately sends an error message when user does not exist instead of waiting until the password is provided, allowing username enumeration.

引入模式

阶段 说明
Architecture and Design -
Implementation -

适用平台

编程语言
Not Language-Specific (Undetermined)

分类映射

分类名称 条目ID 条目名称 映射适配度
PLOVER - Internal behavioral inconsistency infoleak -
关键信息

CWE ID: CWE-206

抽象级别: Variant

结构: Simple

状态: Incomplete

相关弱点