CVE-2024-49580: JetBrains Ktor Information Disclosure

CVE-2024-49580 Overview

CVE-2024-49580 affects JetBrains Ktor versions prior to 2.3.13. The vulnerability stems from improper caching behavior in the HttpCache plugin. An attacker can retrieve cached response information intended for a different user or context, leading to information disclosure over the network.

Ktor is an asynchronous framework used to build connected web applications, HTTP services, and clients in Kotlin. Because the flaw resides in a client-side caching plugin, applications that embed Ktor's HTTP client with HttpCache installed are exposed to cross-request data leakage.

Critical Impact

Response data cached by the Ktor HTTP client may be returned to unintended callers, exposing confidential response content to network-adjacent attackers without authentication.

Affected Products

• JetBrains Ktor versions prior to 2.3.13
• Ktor HTTP client applications with the HttpCache plugin enabled
• Kotlin services and clients built on vulnerable Ktor releases

Discovery Timeline

• 2024-10-17 - CVE-2024-49580 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-49580

Vulnerability Analysis

The weakness is categorized under [CWE-524: Use of Cache Containing Sensitive Information]. The HttpCache plugin stores HTTP responses to accelerate subsequent requests. In vulnerable Ktor releases, the cache key or validation logic does not sufficiently account for request context, allowing cached entries to be served across unrelated requests.

The outcome is confidentiality loss. An attacker who issues a crafted request that matches a cached response can receive data populated by a prior request, including data that originated from a different session or caller. Integrity and availability are not affected.

Root Cause

The root cause is improper handling of cache directives and insufficient scoping of cache entries inside the Ktor client HttpCache plugin. Responses that should have been treated as non-cacheable, or scoped to a specific authorization context, were stored and reused. This behavior conflicts with the caching requirements of RFC 7234 for responses that carry user-specific data.

Attack Vector

Exploitation requires network access to an application that uses the Ktor HTTP client with HttpCache installed. No authentication or user interaction is required. An attacker crafts requests whose cache keys collide with cached responses from other users, then reads the cached response body returned by the client.

No verified public proof-of-concept is available. See the JetBrains Security Issues Fixed advisory for vendor-published details.

Detection Methods for CVE-2024-49580

Indicators of Compromise

• Application responses returning data that does not match the authenticated caller's identity or expected scope.
• Unexpected cache hits in Ktor client logs for endpoints that return user-specific content.
• Repeated requests to the same URL producing responses with mismatched session identifiers or user attributes.

Detection Strategies

• Inventory Kotlin and JVM services that bundle the Ktor client and confirm the installed Ktor version via dependency manifests such as build.gradle.kts or pom.xml.
• Audit application code for install(HttpCache) usage and review which endpoints route through the cached client.
• Review HTTP traffic between the client and upstream services for responses that should carry Cache-Control: private or no-store headers.

Monitoring Recommendations

• Capture Ktor client telemetry and alert on cache hit ratios that spike for endpoints returning authenticated content.
• Correlate application logs with upstream server logs to detect responses served from cache that bypassed the upstream request path.
• Track Software Bill of Materials (SBOM) data for io.ktor:ktor-client-* artifacts below version 2.3.13.

How to Mitigate CVE-2024-49580

Immediate Actions Required

• Upgrade JetBrains Ktor to version 2.3.13 or later across all client dependencies.
• Identify every service that calls install(HttpCache) and validate caching behavior after upgrade.
• Rotate any credentials or tokens that may have been exposed through cached responses.

Patch Information

JetBrains fixed this issue in Ktor 2.3.13. Update the Ktor client dependency version in build configuration files and rebuild affected applications. Vendor-published remediation details are available in the JetBrains Security Issues Fixed advisory.

Workarounds

• Remove install(HttpCache) from the Ktor HTTP client configuration until the upgrade is complete.
• Set Cache-Control: no-store on upstream responses that contain user-specific or sensitive data.
• Segregate Ktor client instances per user or per request scope to prevent cross-request cache reuse.

# Gradle (Kotlin DSL) - pin Ktor to a patched release
implementation("io.ktor:ktor-client-core:2.3.13")
implementation("io.ktor:ktor-client-cio:2.3.13")