CWE-205, Observable Behavioral Discrepancy, covers a product whose behavior shows important differences to unauthorized observers. Those differences reveal either its internal state or decision process, or how it differs from other products that do the same job.
MITRE puts the principle plainly: a product should provide as little information about its internal operations as possible. Otherwise attackers can use what they learn to simplify or optimize an attack. In some cases the differences form a side channel.
How it happens
Behavior leaks when a system reacts to input in a way that depends on hidden state. MITRE's observed examples are network level:
- CVE-2002-0208: a product modifies the TCP/IP stack and ICMP error messages in unusual ways that show the product is in use.
- CVE-2004-2252: a behavioral information leak by responding to SYN-FIN packets.
The same idea applies at the application layer. A service that answers one malformed request one way and a different malformed request another way tells the caller which parser rules it applies.
What an attacker gains
MITRE lists confidentiality and access control effects: reading application data and bypassing a protection mechanism. The practical gain is knowledge. With it, the attacker picks tools and payloads that fit your system instead of guessing.
How to find it
- Probe your own service with unusual but valid-looking input, such as odd packets, headers and encodings, and note any behavior that differs from a standard implementation.
- Compare behavior across states, such as before and after login, to see what the system reveals.
- Treat surprising responses to malformed input as findings to review, not noise.
How to fix it
MITRE does not list mitigations for this entry. Sensible steps follow from its description:
- Make failure paths look alike so internal decisions cannot be read from outside.
- Prefer standard behavior over custom handling of protocol edge cases.
- Remove or normalize anything that exists only to be clever with error responses.
Quick check
Is every behavioral difference a vulnerability?
No. It matters when the difference exposes internal state or decisions to someone who should not see them.
