Skip to content
OpenAdvisories

Weakness (CWE)

CWE-206: Observable Internal Behavioral Discrepancy

Variant Incomplete

The product performs multiple behaviors that are combined to produce a single result, but the individual behaviors are observable separately in a way that allows attackers to reveal internal state or internal decision points.

How to prevent it (2 mitigations)

  1. Requirements, Implementation

    Ideally, the product should provide as little
    information as possible to an attacker. Any hints that
    the attacker may be making progress can then be used to
    simplify or optimize the attack.

    For example, in a login procedure that
    requires a username and password, ultimately there is
    only one decision: success or failure. However,
    internally, two separate actions are performed:
    determining if the username exists, and checking if the
    password is correct. If the product behaves
    differently based on whether the username exists or
    not, then the attacker only needs to concentrate on the
    password.

  2. System Configuration, Implementation

    For error pages, set up generic response pages for error conditions. The error page should not disclose information about the success or failure of a sensitive operation. For instance, the login page should not confirm that the login is correct and the password incorrect. The attacker who tries random account names may be able to guess some of them. Confirming that the account exists would make the login page more susceptible to brute force attack, or possibly leak information about the person who has the account.

Source: MITRE CWE-206

All Critical High Medium Low Exploited only Public exploit

1 result · Feed