CWE-435 (交互错误) — Vulnerability Class 3

CWE-435 represents a systemic architectural weakness where individually secure components interact to create unexpected vulnerabilities within a larger integrated system. This flaw typically emerges when developers assume that combining well-behaved, independent modules will inherently preserve their security properties, ignoring the emergent behaviors that arise during integration. Attackers exploit this by manipulating the interface or data flow between these components, triggering race conditions, state inconsistencies, or logic errors that were not present in isolation. To mitigate this risk, developers must adopt a holistic security approach that extends beyond individual module validation. This involves rigorous interface testing, comprehensive threat modeling of component interactions, and implementing strict validation and sanitization at integration points. By treating the system as a unified entity rather than a collection of isolated parts, engineers can identify and resolve these complex interaction flaws before deployment.