CVE-2024-42214: HCL Aftermarket EPC Information Disclosure

CVE-2024-42214 Overview

CVE-2024-42214 affects HCL Aftermarket EPC, where the web server has the HTTP OPTIONS method enabled. The OPTIONS method returns a list of HTTP methods supported by the server. This information helps attackers narrow their reconnaissance and focus attacks on exposed methods. The issue is classified under [CWE-692] (Incomplete Denylist to Cross-Site Scripting) in the NVD record, but functionally represents an information exposure through improper server configuration.

Critical Impact
An unauthenticated remote attacker can query the web server to enumerate supported HTTP methods, aiding reconnaissance for follow-on attacks.

Affected Products

HCL Aftermarket EPC (specific versions not enumerated in the NVD record)
Web server component exposing the HTTP OPTIONS method
Deployments where the vendor advisory referenced in the HCL Software Knowledge Base Article applies

Discovery Timeline

2026-07-17 - CVE-2024-42214 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2024-42214

Vulnerability Analysis

The web server hosting HCL Aftermarket EPC responds to HTTP OPTIONS requests by returning the list of methods it supports. An attacker sends an OPTIONS request against a target URI and receives an Allow response header enumerating methods such as GET, POST, PUT, DELETE, TRACE, or PATCH. This enumeration accelerates attacker reconnaissance and narrows the surface for follow-on probes.

The vulnerability does not itself grant code execution or data access. It exposes configuration information that supports further attack planning. Methods such as PUT, DELETE, or TRACE are of particular interest when disclosed, since each opens distinct exploitation paths if left enabled without controls.

The EPSS score is 0.197% with a percentile of 9.746, reflecting a low modeled probability of active exploitation. The attack vector is network-based and requires no authentication or user interaction.

Root Cause

The root cause is an insecure default web server configuration. The OPTIONS verb is enabled at the HTTP listener without a restriction policy. Administrators can disable this method through the web server configuration, but the shipped configuration for HCL Aftermarket EPC leaves it active.

Attack Vector

An attacker sends a single HTTP request to any resource served by the application:

OPTIONS / HTTP/1.1
Host: <target>

The server responds with an Allow header listing supported methods. No verified public exploit code exists for this issue. See the HCL Software Knowledge Base Article for vendor guidance.

Detection Methods for CVE-2024-42214

Indicators of Compromise

HTTP requests using the OPTIONS verb targeting HCL Aftermarket EPC endpoints from external or unexpected internal sources
Server responses containing an Allow header enumerating HTTP methods to non-administrative clients
Reconnaissance patterns where OPTIONS requests immediately precede probes against enumerated methods such as PUT or DELETE

Detection Strategies

Configure the web server or reverse proxy to log all OPTIONS requests with source IP, URI, and response headers
Alert on repeated OPTIONS requests from a single source across multiple URIs within a short window
Correlate OPTIONS requests with subsequent non-standard method traffic to identify staged reconnaissance

Monitoring Recommendations

Enable verbose HTTP method logging on the HCL Aftermarket EPC web server
Forward web server logs to a centralized analytics platform for retention and correlation
Include OPTIONS method activity in periodic web application security reviews and vulnerability scans

How to Mitigate CVE-2024-42214

Immediate Actions Required

Disable the HTTP OPTIONS method on the HCL Aftermarket EPC web server unless a documented application requirement exists
Apply the vendor guidance provided in the HCL Software Knowledge Base Article
Restrict access to management interfaces to trusted network segments

Patch Information

HCL has published remediation guidance in the HCL Software Knowledge Base Article. Administrators should follow the vendor instructions to disable unused HTTP methods and apply any accompanying configuration updates.

Workarounds

Block OPTIONS requests at an upstream web application firewall or reverse proxy
Configure the underlying web server (for example IIS, Apache HTTP Server, or NGINX) to reject unused HTTP verbs
Limit inbound access to the EPC web server to authenticated users and known corporate networks

bash

# Example: block OPTIONS at NGINX
if ($request_method = OPTIONS) {
    return 405;
}