CVE-2024-42056
Published: 22 August 2024
Summary
CVE-2024-42056 is a medium-severity Insertion of Sensitive Information into Log File (CWE-532) vulnerability in Retool Retool. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 44.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-39424
Vulnerability details
Retool (self-hosted enterprise) through 3.40.0 inserts resource authentication credentials into sent data. Credentials for users with "Use" permissions can be discovered (by an authenticated attacker) via the /api/resources endpoint. The earliest affected version is 3.18.1.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.
Procedures mandate excluding sensitive data from logs to prevent unauthorized exposure via audit records.
Identifies insertion of sensitive data into logs, allowing detection of unauthorized disclosure.
Cross-organizational coordination enables agreement on what data to include in audit logs, directly reducing insertion of sensitive information.
Identifying logging as a data action allows prevention of sensitive information being inserted into log files.
Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.
The process of identifying and eradicating spilled information applies directly to sensitive data inserted into log files.
Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.