CWE-437, Incomplete Model of Endpoint Features, describes a product that sits between two or more endpoints and watches or relays their traffic, but does not fully understand how those endpoints behave. Because its mental picture is wrong, it takes the wrong action.
This hits anything that acts as a middleman: intrusion detection systems, web proxies, mail scanners, application firewalls and load balancers.
How it happens
The intermediary has to guess how the endpoint will interpret each byte. When the guess differs from reality, an attacker can send something the middleman reads one way and the endpoint reads another.
MITRE gives two examples. HTTP request smuggling works because a proxy expects the client to parse headers one way while the client parses them differently. And an antivirus product on a mail server may treat an attachment type as safe, not knowing the mail client is configured to treat it as executable.
A recent observed case is CVE-2024-55629: a network-based IDS did not model how TCP endpoints handle TCP urgent data, so attackers could bypass detection.
What an attacker gains
MITRE lists the consequences as integrity impact, an unexpected state, and effects that vary by context. In practice the common prize is evasion. Traffic that should have been blocked or flagged passes through, because the control looked at a different version of the message than the one the endpoint acted on.
How to find it
The record lists no specific detection methods, so this is a design review question. For each intermediary you run, ask which endpoint behaviors it must replicate. Then test it against odd inputs: duplicate headers, unusual flags, overlapping fragments, unexpected encodings. Compare what the middlebox logs with what the endpoint actually did.
How to fix it
MITRE lists no formal mitigations for this entry. These steps follow from the weakness itself:
- Document the endpoints behind each intermediary, including their versions and configuration.
- Normalize or reject ambiguous messages at the middlebox instead of passing them on.
- Keep the middlebox and the endpoints on compatible, current protocol versions.
- Do not treat one inspection layer as the only control. Enforce important rules at the endpoint too.
Quick check
Why can a mail scanner miss a dangerous attachment?
It may not know how the recipient's mail client handles that file type. If the client treats it as executable and the scanner treats it as safe, the scanner's model of the endpoint is incomplete.
