CWE-203 (通过差异性导致的信息暴露) — Vulnerability Class 195

CWE-203, Observable Discrepancy, is a design weakness where a system’s behavior or responses vary noticeably based on specific conditions, revealing internal state information to unauthorized actors. Attackers typically exploit this by crafting inputs that trigger distinct error messages, timing delays, or response codes, allowing them to infer sensitive data such as user existence or system architecture through side-channel analysis. To mitigate this risk, developers must ensure consistent error handling and response formatting across all execution paths. This involves standardizing error messages, masking internal details, and implementing uniform response times regardless of the underlying cause. By abstracting internal logic and preventing information leakage through observable differences, organizations can significantly reduce the attack surface, ensuring that external interactions remain opaque and do not inadvertently aid adversaries in reconnaissance or exploitation efforts.