CWE-203 Base Incomplet

Observable Discrepancy

Définition

What is CWE-203?

This vulnerability occurs when an application responds differently to unauthorized users based on internal conditions. Attackers can observe these variations—like changes in error messages, timing, or system behavior—to infer sensitive information, such as whether a username exists, a password is incorrect, or a specific operation succeeded.

Observable discrepancies act as unintended information leaks, providing attackers with clues about your system's internal state. These variations can appear in multiple forms: differences in response times (timing attacks), changes in error messages or HTTP status codes, alternate control flows, or even subtle behavioral shifts in the application. Attackers systematically probe these differences to map valid user accounts, guess credentials, or determine the structure of backend systems. In practice, this flaw often enables brute-force attacks or reconnaissance by removing the "blindness" from an attacker's attempts. For example, a login endpoint that returns "invalid username" versus "invalid password" tells an attacker exactly which piece of data is correct. Over time, these small information leaks can be combined to form a complete side channel, bypassing security controls that rely on keeping the system's responses uniform and unpredictable.

Impact réel

Real-world CVEs caused by CWE-203

CVE-2020-8695

Observable discrepancy in the RAPL interface for some Intel processors allows information disclosure.
CVE-2019-14353

Crypto hardware wallet's power consumption relates to total number of pixels illuminated, creating a side channel in the USB connection that allows attackers to determine secrets displayed such as PIN numbers and passwords
CVE-2019-10071

Java-oriented framework compares HMAC signatures using String.equals() instead of a constant-time algorithm, causing timing discrepancies
CVE-2002-2094

This, and others, use ".." attacks and monitor error responses, so there is overlap with directory traversal.
CVE-2001-1483

Enumeration of valid usernames based on inconsistent responses
CVE-2001-1528

Account number enumeration via inconsistent responses.
CVE-2004-2150

User enumeration via discrepancies in error messages.
CVE-2005-1650

User enumeration via discrepancies in error messages.

Comment les attaquants l'exploitent

Parcours de l'attaquant étape par étape

1
The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.
2
In the above code, there are different messages for when an incorrect username is supplied, versus when the username is correct but the password is wrong. This difference enables a potential attacker to understand the state of the login function, and could allow an attacker to discover a valid username by trying different values until the incorrect password message is returned. In essence, this makes it easier for an attacker to obtain half of the necessary authentication credentials.
3
While this type of information may be helpful to a user, it is also useful to a potential attacker. In the above example, the message for both failed cases should be the same, such as:
4
In this example, the attacker observes how long an authentication takes when the user types in the correct password.
5
When the attacker tries their own values, they can first try strings of various length. When they find a string of the right length, the computation will take a bit longer, because the for loop will run at least once. Additionally, with this code, the attacker can possibly learn one character of the password at a time, because when they guess the first character right, the computation will take longer than a wrong guesses. Such an attack can break even the most sophisticated password with a few hundred guesses.

Exemple de code vulnérable

Vulnerable Perl

The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.

Vulnérable Perl

my $username=param('username'); 
  my $password=param('password'); 
  if (IsValidUsername($username) == 1) 
  { 
  	if (IsValidPassword($username, $password) == 1) 
  	{ 
  		print "Login Successful"; 
  	} 
  	else 
  	{ 
  		print "Login Failed - incorrect password"; 
  	} 
  } 
  else 
  { 
  	print "Login Failed - unknown username"; 
  }

Exemple de code sécurisé

Secure Other

In the example above, an attacker may vary the inputs, then observe differences between processing times (since different plaintexts take different time). This could be used to infer information about the key.

Sécurisé Other

Artificial delays may be added to ensure that all calculations take equal time to execute.

What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.

Liste de contrôle de prévention

How to prevent CWE-203

Architecture and Design Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Implementation Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.

Signaux de détection

How to detect CWE-203

SAST High

Exécuter une analyse statique (SAST) sur le code source à la recherche du motif non sécurisé dans le flux de données.

DAST Moderate

Exécuter des tests de sécurité applicative dynamique (DAST) contre le point de terminaison en ligne.

Runtime Moderate

Surveiller les journaux runtime pour détecter des traces d'exception inhabituelles, des entrées malformées ou des tentatives de contournement d'autorisation.

Code review Moderate

Revue de code : signaler tout nouveau code qui traite les entrées de cette surface sans utiliser les helpers du framework validés.

Correction automatique Plexicus

Plexicus détecte automatiquement CWE-203 et ouvre une PR de correction en moins de 60 secondes.

Codex Remedium analyse chaque commit, identifie cette faiblesse précise et livre une pull request prête à être relue avec le correctif. Pas de tickets. Pas de transferts.

Obtenir une démo Essayer Plexicus gratuitement

Questions fréquentes

Frequently asked questions

Qu'est-ce que CWE-203 ?

Quelle est la gravité de CWE-203 ?

MITRE n'a pas publié de note de probabilité d'exploitation pour cette faiblesse. Traitez-la comme un impact moyen jusqu'à ce que votre modèle de menace prouve le contraire.

Quels langages ou plateformes sont affectés par CWE-203 ?

MITRE lists the following affected platforms: Not Technology-Specific.

Comment puis-je prévenir CWE-203 ?

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to…

Comment Plexicus détecte et corrige CWE-203 ?

Le moteur SAST de Plexicus reconnaît la signature de flux de données de CWE-203 à chaque commit. Lorsqu'une correspondance est trouvée, notre agent Codex Remedium ouvre une PR de correction avec le code corrigé, les tests et un résumé d'une ligne pour le relecteur.

Où puis-je en savoir plus sur CWE-203 ?

MITRE publie la définition canonique à https://cwe.mitre.org/data/definitions/203.html. Vous pouvez également consulter la documentation OWASP et NIST pour des conseils adjacents.

Faiblesses associées

Weaknesses related to CWE-203

CWE-200 Parent

Exposure of Sensitive Information to an Unauthorized Actor

This weakness occurs when an application unintentionally reveals sensitive data to someone who shouldn't have access to it.

CWE-1258 Frère

Exposure of Sensitive System Information Due to Uncleared Debug Information

This vulnerability occurs when hardware fails to erase sensitive data like cryptographic keys and intermediate values before entering…

CWE-1273 Frère

Device Unlock Credential Sharing

This vulnerability occurs when the secret keys or passwords required to unlock a device's hidden features are shared between multiple…

CWE-1295 Frère

Debug Messages Revealing Unnecessary Information

The product's debug messages or logs expose excessive internal system details, potentially revealing sensitive information that could aid…

CWE-1431 Frère

Driving Intermediate Cryptographic State/Results to Hardware Module Outputs

This vulnerability occurs when a hardware cryptographic module leaks sensitive internal data through its output channels. Instead of only…

CWE-201 Frère

Insertion of Sensitive Information Into Sent Data

This vulnerability occurs when an application sends data to an external party, but accidentally includes sensitive information—like…

CWE-209 Frère

Generation of Error Message Containing Sensitive Information

This vulnerability occurs when an application reveals sensitive details about its internal systems, user data, or environment within error…

CWE-213 Frère

Exposure of Sensitive Information Due to Incompatible Policies

This vulnerability occurs when a system's data handling aligns with the developer's security rules but accidentally reveals information…

CWE-215 Frère

Insertion of Sensitive Information Into Debugging Code

This vulnerability occurs when developers embed sensitive data, such as passwords or API keys, within debugging statements like logs or…

Ressources

Arrêtez de payer par développeur.
Commencez à fermer la boucle.

Plexicus est l'ASPM natif IA qui scanne, filtre, corrige, penteste et explique — de façon autonome. Développeurs illimités, dépôts illimités, actions IA à usage équitable. Vrai niveau gratuit, €269/mo annuel quand vous êtes prêt.

Commencer gratuitement Réserver une démo