CWE-203 Base Incompleto

Observable Discrepancy

Definição

What is CWE-203?

This vulnerability occurs when an application responds differently to unauthorized users based on internal conditions. Attackers can observe these variations—like changes in error messages, timing, or system behavior—to infer sensitive information, such as whether a username exists, a password is incorrect, or a specific operation succeeded.

Observable discrepancies act as unintended information leaks, providing attackers with clues about your system's internal state. These variations can appear in multiple forms: differences in response times (timing attacks), changes in error messages or HTTP status codes, alternate control flows, or even subtle behavioral shifts in the application. Attackers systematically probe these differences to map valid user accounts, guess credentials, or determine the structure of backend systems. In practice, this flaw often enables brute-force attacks or reconnaissance by removing the "blindness" from an attacker's attempts. For example, a login endpoint that returns "invalid username" versus "invalid password" tells an attacker exactly which piece of data is correct. Over time, these small information leaks can be combined to form a complete side channel, bypassing security controls that rely on keeping the system's responses uniform and unpredictable.

Impacto no mundo real

Real-world CVEs caused by CWE-203

CVE-2020-8695

Observable discrepancy in the RAPL interface for some Intel processors allows information disclosure.
CVE-2019-14353

Crypto hardware wallet's power consumption relates to total number of pixels illuminated, creating a side channel in the USB connection that allows attackers to determine secrets displayed such as PIN numbers and passwords
CVE-2019-10071

Java-oriented framework compares HMAC signatures using String.equals() instead of a constant-time algorithm, causing timing discrepancies
CVE-2002-2094

This, and others, use ".." attacks and monitor error responses, so there is overlap with directory traversal.
CVE-2001-1483

Enumeration of valid usernames based on inconsistent responses
CVE-2001-1528

Account number enumeration via inconsistent responses.
CVE-2004-2150

User enumeration via discrepancies in error messages.
CVE-2005-1650

User enumeration via discrepancies in error messages.

Como os atacantes a exploram

Trajeto do atacante passo a passo

1
The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.
2
In the above code, there are different messages for when an incorrect username is supplied, versus when the username is correct but the password is wrong. This difference enables a potential attacker to understand the state of the login function, and could allow an attacker to discover a valid username by trying different values until the incorrect password message is returned. In essence, this makes it easier for an attacker to obtain half of the necessary authentication credentials.
3
While this type of information may be helpful to a user, it is also useful to a potential attacker. In the above example, the message for both failed cases should be the same, such as:
4
In this example, the attacker observes how long an authentication takes when the user types in the correct password.
5
When the attacker tries their own values, they can first try strings of various length. When they find a string of the right length, the computation will take a bit longer, because the for loop will run at least once. Additionally, with this code, the attacker can possibly learn one character of the password at a time, because when they guess the first character right, the computation will take longer than a wrong guesses. Such an attack can break even the most sophisticated password with a few hundred guesses.

Exemplo de código vulnerável

Vulnerable Perl

The following code checks validity of the supplied username and password and notifies the user of a successful or failed login.

Vulnerável Perl

my $username=param('username'); 
  my $password=param('password'); 
  if (IsValidUsername($username) == 1) 
  { 
  	if (IsValidPassword($username, $password) == 1) 
  	{ 
  		print "Login Successful"; 
  	} 
  	else 
  	{ 
  		print "Login Failed - incorrect password"; 
  	} 
  } 
  else 
  { 
  	print "Login Failed - unknown username"; 
  }

Exemplo de código seguro

Secure Other

In the example above, an attacker may vary the inputs, then observe differences between processing times (since different plaintexts take different time). This could be used to infer information about the key.

Seguro Other

Artificial delays may be added to ensure that all calculations take equal time to execute.

What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.

Lista de verificação de prevenção

How to prevent CWE-203

Architecture and Design Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
Implementation Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.

Sinais de deteção

How to detect CWE-203

SAST High

Executar análise estática (SAST) na base de código à procura do padrão inseguro no fluxo de dados.

DAST Moderate

Executar testes dinâmicos de segurança de aplicações (DAST) contra o endpoint em execução.

Runtime Moderate

Monitorizar os registos em tempo de execução para traços de exceção invulgares, input malformado ou tentativas de contornar a autorização.

Code review Moderate

Revisão de código: sinalizar qualquer novo código que trate input desta superfície sem usar os ajudantes validados do framework.

Correção automática do Plexicus

O Plexicus deteta automaticamente o CWE-203 e abre um PR de correção em menos de 60 segundos.

O Codex Remedium analisa cada commit, identifica esta fraqueza exata e entrega um pull request pronto para revisão com o patch. Sem tickets. Sem transferências.

Obter uma demonstração Experimente o Plexicus gratuitamente

Perguntas frequentes

Frequently asked questions

O que é o CWE-203?

Qual a gravidade do CWE-203?

A MITRE não publicou uma classificação de probabilidade de exploração para esta fraqueza. Trate-a como impacto médio até o seu modelo de ameaças provar o contrário.

Que linguagens ou plataformas são afetadas pelo CWE-203?

MITRE lists the following affected platforms: Not Technology-Specific.

Como posso prevenir o CWE-203?

Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to…

Como é que o Plexicus deteta e corrige o CWE-203?

O motor SAST do Plexicus correlaciona a assinatura de fluxo de dados do CWE-203 em cada commit. Quando é encontrada uma correspondência, o nosso agente Codex Remedium abre um PR de correção com o código corrigido, testes e um resumo de uma linha para o revisor.

Onde posso saber mais sobre o CWE-203?

A MITRE publica a definição canónica em https://cwe.mitre.org/data/definitions/203.html. Pode também consultar a documentação da OWASP e do NIST para orientações adjacentes.

Fraquezas relacionadas

Weaknesses related to CWE-203

CWE-200 Pai

Exposure of Sensitive Information to an Unauthorized Actor

This weakness occurs when an application unintentionally reveals sensitive data to someone who shouldn't have access to it.

CWE-1258 Irmão

Exposure of Sensitive System Information Due to Uncleared Debug Information

This vulnerability occurs when hardware fails to erase sensitive data like cryptographic keys and intermediate values before entering…

CWE-1273 Irmão

Device Unlock Credential Sharing

This vulnerability occurs when the secret keys or passwords required to unlock a device's hidden features are shared between multiple…

CWE-1295 Irmão

Debug Messages Revealing Unnecessary Information

The product's debug messages or logs expose excessive internal system details, potentially revealing sensitive information that could aid…

CWE-1431 Irmão

Driving Intermediate Cryptographic State/Results to Hardware Module Outputs

This vulnerability occurs when a hardware cryptographic module leaks sensitive internal data through its output channels. Instead of only…

CWE-201 Irmão

Insertion of Sensitive Information Into Sent Data

This vulnerability occurs when an application sends data to an external party, but accidentally includes sensitive information—like…

CWE-209 Irmão

Generation of Error Message Containing Sensitive Information

This vulnerability occurs when an application reveals sensitive details about its internal systems, user data, or environment within error…

CWE-213 Irmão

Exposure of Sensitive Information Due to Incompatible Policies

This vulnerability occurs when a system's data handling aligns with the developer's security rules but accidentally reveals information…

CWE-215 Irmão

Insertion of Sensitive Information Into Debugging Code

This vulnerability occurs when developers embed sensitive data, such as passwords or API keys, within debugging statements like logs or…

Recursos

Pare de pagar por desenvolvedor.
Comece a fechar o ciclo.

O Plexicus é o ASPM nativo de IA que verifica, filtra, corrige, pentesta e explica — de forma autónoma. Programadores ilimitados, repos ilimitados, ações de IA de utilização justa. Nível gratuito real, €269/mo anual quando estiver pronto.

Começar grátis Reservar uma demo