HCL Aftermarket EPC Flaw Risks Data Loss

A severe security vulnerability has been identified within HCL Aftermarket EPC, posing a significant risk to the integrity of user credentials. The flaw revolves around the application's handling of specific requests, which currently lacks the necessary validation to prevent unauthorized access.

Vulnerability Logic Breakdown

The issue is classified as a business logic vulnerability, carrying a critical severity rating with a CVSS score of 9.1. According to the advisory, the flaw allows an individual who is not a valid user of the application to manipulate the server's response. By exploiting this, an attacker can obtain passwords from the server and force them to be sent to an email address of their choosing.

Missing Validation Controls

The core of the problem lies in inconsistent verification processes. While the software does perform checks on initial requests to confirm the validity of a provided UserId, these protections are not replicated elsewhere. Specifically, the application fails to apply similar validation protocols when processing email requests to distribute passwords to users.

Documented Technical Data

• Advisory Identifier: GHSA-wmr2-f2gc-hxq6
• Associated CVE: CVE-2024-23564
• CVSS Severity Score: 9.1

Operational Implications

The discrepancy in how the system treats initial authentication versus later password-related communication creates an opening for exploitation. Because the system does not enforce strict checks on email-bound data, the path from unauthorized request to credential interception is left open. Organizations relying on this platform may need to review their current deployment configurations to understand how this business logic failure affects their specific environment.