CVE-2024-23567: HCL Aftermarket EPC Information Disclosure

CVE-2024-23567 Overview

CVE-2024-23567 affects HCL Aftermarket EPC and involves sensitive information transmitted via HTTP GET requests and URL parameters. The application passes sensitive data through URL query strings during normal usage. This data can persist in server access logs, browser history, and intermediate proxy logs. Attackers with access to any of these storage locations can recover the exposed values without exploiting an active session.

The issue is categorized under [CWE-804] and reflects an information disclosure weakness rather than direct code execution or privilege escalation.

Critical Impact
Sensitive data submitted through URL parameters in HCL Aftermarket EPC can be recovered from server logs, browser history, and proxy caches, exposing confidential information to anyone with read access to those artifacts.

Affected Products

HCL Aftermarket EPC
Deployments transmitting sensitive parameters through HTTP GET requests
Environments where server access logs or proxy logs are retained without redaction

Discovery Timeline

2026-07-17 - CVE-2024-23567 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2024-23567

Vulnerability Analysis

The vulnerability originates in how HCL Aftermarket EPC transmits sensitive parameters between the client and server. The application uses HTTP GET requests that place confidential values directly in the URL query string. Unlike request bodies used by POST methods, URL parameters are logged by virtually every intermediate component that handles the request.

Web servers record complete request lines in access logs. Browsers store visited URLs in history and autocomplete stores. Forward and reverse proxies capture the same URLs in their own log pipelines. Referer headers can also leak the URL to third-party sites embedded in the response.

Exploitation requires user interaction, as noted by the vector component UI:R, but does not require authentication. The impact is limited to confidentiality; integrity and availability are not affected.

Root Cause

The root cause is a design decision to send sensitive data through HTTP GET requests rather than POST bodies or headers protected by TLS-only channels. The application does not classify parameters by sensitivity before selecting the HTTP method used to transmit them.

Attack Vector

An attacker who obtains read access to server access logs, load balancer logs, proxy caches, browser history on a shared workstation, or referer entries in downstream services can recover the sensitive parameters. Network-adjacent adversaries who compromise logging infrastructure or backup archives can extract the same values in bulk.

No verified proof-of-concept code is publicly available. The vulnerability is described in the HCL Software Knowledge Base Article.

Detection Methods for CVE-2024-23567

Indicators of Compromise

Access log entries containing sensitive tokens, identifiers, or credentials in the query string of requests to HCL Aftermarket EPC endpoints
Referer headers in downstream applications that reveal sensitive parameters from Aftermarket EPC URLs
Proxy or CDN cache entries retaining URLs with confidential values

Detection Strategies

Review historical web server, reverse proxy, and load balancer logs for URLs to Aftermarket EPC that contain parameters matching sensitive data patterns
Inspect browser history exports on shared or kiosk workstations that access the application
Correlate log access events with users who lack a business need to view raw request logs

Monitoring Recommendations

Centralize web server and proxy logs and apply pattern matching for parameter names associated with sensitive data
Ingest access logs into a SIEM such as Singularity Data Lake to run OCSF-normalized queries across historical requests and flag continued use of GET for sensitive endpoints
Alert on unusual read access to log storage buckets, log servers, and backup archives

How to Mitigate CVE-2024-23567

Immediate Actions Required

Apply the vendor guidance described in the HCL Software Knowledge Base Article
Rotate any credentials, tokens, or identifiers that were previously transmitted through URL parameters
Purge or redact historical access logs, proxy caches, and browser history that retain sensitive query strings

Patch Information

HCL has published remediation guidance in knowledge base article KB0132294. Apply the referenced fixes so the application transmits sensitive fields through request bodies or protected headers rather than URL parameters. Confirm that upstream and downstream components are updated to match.

Workarounds

Configure reverse proxies to strip sensitive parameters from logged request lines
Disable referer header propagation from Aftermarket EPC responses using Referrer-Policy: no-referrer
Restrict read access to web server and proxy log storage to a minimal set of administrators

bash

# Configuration example: prevent referer leakage and reduce log retention of query strings
# Nginx: strip query string from access logs for the Aftermarket EPC location
log_format sanitized '$remote_addr - $remote_user [$time_local] '
                    '"$request_method $uri $server_protocol" '
                    '$status $body_bytes_sent';

location /aftermarket-epc/ {
    access_log /var/log/nginx/epc.log sanitized;
    add_header Referrer-Policy "no-referrer" always;
}