CWE-204: Observable Response Discrepancy

When similar inputs produce observably different responses, an external actor can use the discrepancy to infer information that should not be available to them. For example, different failed-login messages can reveal whether a username is valid. This disclosure can help an attacker refine subsequent attacks, and may result from either an inadvertent implementation defect or an intentional but unsafe design choice.

This weakness occurs when similar requests produce distinguishable responses, such as different error messages, response content, or packet properties. The discrepancy can reveal internal state, including whether a username, account, file, directory, or network port exists. It frequently arises in authentication and error handling during architecture, design, or implementation, and is not specific to a programming language.

The primary potential impacts are confidentiality and access control. An attacker may read or infer application data, such as valid usernames or the existence of resources, and may bypass protection mechanisms by using that information to improve enumeration, password-guessing, or other attacks.

Architecture and design: Compartmentalize the system so that trust boundaries are unambiguous, sensitive data remains within the appropriate boundary, and privilege separation is reinforced through least privilege. Implementation: Keep error messages to the minimum detail needed by the intended audience, avoid revealing how an error was determined, and avoid inconsistent messages that disclose internal state such as whether an account exists. If detailed errors must be captured, place them in logs while considering whether attackers could access those logs, and never log highly sensitive information such as passwords.

The official record does not specify a detection method for this weakness.

The following are representative examples, not an exhaustive list:

• CVE-2002-2094: Monitors error responses during .. attacks, with overlap with directory traversal.
• CVE-2001-1483: Enumerates valid usernames based on inconsistent responses.
• CVE-2001-1528: Enumerates account numbers through inconsistent responses.
• CVE-2004-2150 and CVE-2005-1650: Enable user enumeration through discrepancies in error messages.
• CVE-2004-0294: A bulletin board displays different messages depending on whether a user exists, helping identify valid users and conduct brute-force password guessing.
• CVE-2004-0243: An operating system displays different messages when direct remote login is disabled, enabling password guessing through brute-force methods.
• CVE-2002-0514 and CVE-2002-0515: Different TTL values reveal whether a port is filtered.
• CVE-2001-1387: The product may generate responses different from those specified by the administrator, potentially causing an information leak.
• CVE-2004-0778: A version control system returns different errors for the -X option, revealing the existence of arbitrary files and directories.
• CVE-2004-1428: An FTP server returns an error when a username does not exist instead of prompting for a password, revealing valid usernames.