CWE-1068 is a product whose implementation is not consistent with the design in its documentation. MITRE lists it as not technology specific, and it also applies to ICS/OT. Any team with design documents can suffer from it.
How it happens
The design says all requests are authenticated at the gateway. Later, one internal route is added that skips it. The document is never changed. Everyone who reads it believes something that is no longer true.
Typical causes:
- A hotfix changes behavior and not the document.
- Two teams build from different versions of the design.
- A design was never implemented fully, and nobody noted the gap.
What an attacker gains
MITRE lists reduced maintainability and increased analytical complexity. Inconsistencies make the product harder to maintain, which "indirectly affects security by making it more difficult or time-consuming to find and/or fix vulnerabilities," and may make it easier to introduce them.
The practical danger is false assurance. A security review that checks the design will not find a flaw that exists only in the implementation.
How to find it
The record lists no detection methods. Try these:
- Pick a security claim in the design, such as where authorization is enforced, and trace it through the code.
- Compare the documented interfaces with the real ones, for example against a generated API description.
- Test the documented behavior directly, and file a bug for every mismatch.
How to fix it
- Decide which side is right for each mismatch: fix the code or fix the document.
- Update documentation in the same change as behavior.
- Add tests that encode the documented design, so drift fails the build.
- Re-run design reviews when the code changes in a security-relevant way.
Quick check
Why is a mismatch dangerous even when the code is fine?
Reviewers rely on the document. If it is wrong, they may approve or miss things based on a picture that no longer matches the product.
