CWE-235 covers products that do not handle, or handle incorrectly, the case where the number of parameters, fields or arguments with the same name exceeds the expected amount.
The classic form is a request that repeats a name. Does the server take the first value, the last, or all of them joined together? Different components answer differently, and the gap between those answers is where attackers work.
How it happens
Imagine a gateway that inspects a request and a backend that acts on it. A client sends the same field twice. The gateway reads the first copy and sees something harmless. The backend reads the last copy and sees something else.
Neither side is wrong by its own rules. The weakness is that the two sides never agreed on a rule, or that one side never expected duplicates at all.
MITRE gives one observed example, CVE-2003-1014. Multiple gateway and security products allowed a restriction bypass using multiple MIME fields with the same name, which were interpreted differently by clients.
What an attacker gains
The record lists an integrity impact: the product ends up in an unexpected state. In the example above, that state was a bypassed restriction. A filter believed the content was allowed, and the receiving client acted on different content.
How to find it
The record lists no detection methods for this entry. Practical checks:
- Send each parameter twice with different values and see which one wins at every layer.
- Compare how your proxy, framework and application each parse the same raw request.
- Add duplicate field cases to fuzzing inputs.
How to fix it
The record has no mitigation list, so these are practical steps drawn from the description.
- Pick one rule for duplicates, such as reject, first wins or last wins, and enforce it at the edge.
- Make security checks run on the same parsed form that the application later uses.
- Reject requests with repeated names for fields that should appear once.
Quick check
Why do duplicate parameters cause bypasses?
Because two components can read the same input differently. A check passes on one value while the consumer uses another.
