CWE-435 describes an interaction error: two entities behave correctly on their own, but when integrated into a larger system they produce incorrect behavior that can lead to weaknesses. MITRE explains that combining independent components creates new, emergent behaviors, and some of them can be insecure if the interactions are not fully accounted for.
How it happens
Each team tests its own piece. Nobody owns the seam. One component normalizes input one way, the next assumes another.
MITRE's examples:
- An antivirus product could be bypassed with mixed case Content-Type and Content-Disposition headers, which some clients still processed (CVE-2002-0485).
- Code ported from case sensitive Unix to case insensitive Windows, where file type handlers treat .jsp and .JSP as different extensions, allowed JSP source to be read (CVE-2003-0411).
Neither the Unix code nor the Windows file system was wrong. The pairing was.
What an attacker gains
The record lists integrity impact and an unexpected state, varying by context. Examples above ended in filter bypass and source disclosure.
How to find it
The record lists no detection methods. Practical approaches:
- Draw the data flow between components and write down what each one assumes about case, encoding, length and format.
- Test integrations with boundary inputs: mixed case, odd encodings, duplicate fields.
- Re-test after porting, upgrading or swapping a component.
How to fix it
- Normalize input once, early, and pass the normalized form on.
- Document assumptions at each interface and test them.
- Add integration tests, not just unit tests.
- Treat platform changes as security relevant changes.
Where to look first
Pick the places where two systems hand data to each other and one of them makes a security decision: a gateway in front of an application, a scanner that inspects files a client will open, a migration from one operating system or framework to another. Ask what each side does with uppercase and lowercase, encodings, duplicate fields and trailing characters. Any difference is a candidate bug.
Quick check
If each component passes its tests, are we safe?
Not necessarily. The failure lives in how they interact, which only integration tests exercise.
