CVE-2024-23571 Overview
CVE-2024-23571 affects HCL Aftermarket EPC, a web-based electronic parts catalog application. The application fails to define an appropriate caching policy for pages containing sensitive form fields. Browsers and intermediate caches may retain response data on local disk after a user session ends. Any subsequent user with access to the same computer can retrieve cached content, including form values and session context. The weakness is categorized as [CWE-525] Use of Web Browser Cache Containing Sensitive Information. The issue requires user interaction and network access to the application but no authentication on the attacker's side.
Critical Impact
Sensitive information rendered in application responses may be recovered from the local browser cache by later users sharing the same workstation.
Affected Products
- HCL Aftermarket EPC (Electronic Parts Catalog)
- Web front-end pages that render sensitive form fields
- Shared or multi-user workstation deployments accessing the application
Discovery Timeline
- 2026-07-17 - CVE-2024-23571 published to NVD
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2024-23571
Vulnerability Analysis
HCL Aftermarket EPC returns HTTP responses without cache-control directives that instruct clients to avoid storing sensitive content. Modern browsers cache resources aggressively when servers do not explicitly forbid it. Pages containing form fields, session identifiers, or business data are written to local browser storage. On shared systems such as kiosks, dealership terminals, or common workstations, an attacker with local access can browse the cached history to recover this material. Exploitation depends on victim interaction with the vulnerable application followed by attacker access to the same endpoint. The confidentiality impact is limited to data previously rendered to the victim.
Root Cause
The application does not emit HTTP response headers such as Cache-Control: no-store, Cache-Control: no-cache, Pragma: no-cache, or an appropriate Expires value on responses containing sensitive data. Without these directives, the browser default caching behavior applies. The weakness maps to [CWE-525], where sensitive information is stored in a web browser's cache that a subsequent user or process can access.
Attack Vector
The attack requires physical or remote access to a workstation previously used to interact with HCL Aftermarket EPC. The attacker opens the browser cache directory, extracts cached HTML or resource files, and reads sensitive fields that were rendered during the prior session. Alternatively, the attacker navigates back through browser history to force reload from cache. No network exploit or authentication bypass is required at the attacker stage. The vulnerability is passive and depends on prior legitimate use.
No public proof-of-concept code is available. The vulnerability manifests through missing HTTP response headers rather than an exploitable code path, so no exploit script is required to demonstrate the issue. Refer to the HCL Software Knowledge Base Article for vendor technical details.
Detection Methods for CVE-2024-23571
Indicators of Compromise
- Presence of HCL Aftermarket EPC HTML pages within browser cache directories on shared workstations.
- HTTP responses from the application missing Cache-Control: no-store or equivalent directives.
- Browser history entries showing pages loaded from cache rather than the server after logout.
Detection Strategies
- Inspect HTTP response headers returned by the application using a proxy such as Burp Suite or curl -I and confirm the absence of no-store directives.
- Audit endpoint file systems on shared hosts for cached artifacts under browser profile paths that reference the EPC application URL.
- Review network capture data for responses to authenticated EPC endpoints that lack cache-suppression headers.
Monitoring Recommendations
- Log and alert on repeated access to browser cache directories on shared endpoints by non-owner user accounts.
- Track user session termination events and correlate with subsequent local access to the same workstation by different accounts.
- Add web application scanning rules that flag responses containing form fields but no cache-control policy.
How to Mitigate CVE-2024-23571
Immediate Actions Required
- Apply the guidance and any fixes described in the HCL Software Knowledge Base Article for HCL Aftermarket EPC.
- Configure the application or reverse proxy to send Cache-Control: no-store, no-cache, must-revalidate on all responses containing sensitive data.
- Instruct users on shared workstations to clear browser cache and history after each session.
Patch Information
HCL Software has published remediation guidance in knowledge base article KB0132294. Administrators should consult the vendor advisory for the fixed version and configuration recommendations. Because no fixed version is enumerated in NVD, review the vendor knowledge base directly to confirm patched builds.
Workarounds
- Deploy a reverse proxy or web application gateway that appends Cache-Control: no-store and Pragma: no-cache headers to all EPC responses.
- Restrict access to the application to non-shared devices or enforce per-user desktop profiles that isolate browser caches.
- Configure managed browsers to disable disk caching for the application's hostname through enterprise policy.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
