CVE-2024-23686

Executive Summary

CVE-2024-23686 is a security advisory affecting OWASP DependencyCheck for Maven (9.0.0 to 9.0.6), CLI (9.0.0 to 9.0.5), and Ant (9.0.0 to 9.0.5). When DependencyCheck is run in debug mode, the NVD API Key is written in plaintext to the log file. An attacker with local file system access or the ability to read log files (e.g., via a log aggregation service) can recover this key. The NVD API Key is used to query the National Vulnerability Database, and its compromise could lead to unauthorized API usage, rate limiting, or data exfiltration.

Supply Chain & Package Security

This vulnerability is specific to the OWASP DependencyCheck tool, which is used in software supply chain security to identify known vulnerabilities in project dependencies. The exposure of the NVD API Key undermines the integrity of the scanning process and could allow an attacker to manipulate or intercept vulnerability data.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (No official CVSS vector assigned)
• Threat Level: Medium (based on the requirement for debug mode and local access)
• Attack Vector: Local (requires access to log files)
• Attack Complexity: Low
• Privileges Required: Low (read access to log files)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (API key exposure)
• Integrity Impact: None
• Availability Impact: None

Deep Dive & Mechanics

The vulnerability exists because DependencyCheck, when configured with --debug or equivalent debug logging, outputs the NVD API Key as part of the initialization or request logging. The key is typically passed as a parameter or environment variable and is logged without sanitization.

Root Cause: The logging framework (likely Log4j or SLF4J) is configured to log all parameters at DEBUG level, including sensitive credentials.

Attack Scenario:

1. An attacker gains read access to the log files (e.g., via a compromised CI/CD pipeline, shared logging system, or local file inclusion).
2. The attacker searches for the NVD API Key pattern (e.g., nvdApiKey=... or apiKey=...).
3. The attacker uses the key to query the NVD API, potentially exhausting the quota or performing reconnaissance.

Vulnerable vs. Patched Code

Vulnerable Code (9.0.0 - 9.0.6):

// Example from DependencyCheck core
if (log.isDebugEnabled()) {
    log.debug("NVD API Key: {}", nvdApiKey);
}

Patched Code (9.0.7+):

if (log.isDebugEnabled()) {
    log.debug("NVD API Key: [REDACTED]");
}

The fix replaces the actual key value with a static redaction string.

Exploitation & Lab Setup

Red Team

Prerequisites:

• OWASP DependencyCheck 9.0.0 to 9.0.6 (Maven, CLI, or Ant)
• Debug mode enabled (e.g., --debug flag)
• Access to the generated log file

Steps:

1. Run DependencyCheck in debug mode:

   dependency-check.sh --debug --nvdApiKey YOUR_API_KEY --scan /path/to/project
   

2. Locate the log file (default: dependency-check.log in the current directory).
3. Extract the API key:

   grep -oP 'nvdApiKey=\K[^ ]+' dependency-check.log
   

4. Use the key to query the NVD API:

   curl -H "apiKey: YOUR_API_KEY" "https://services.nvd.nist.gov/rest/json/cves/2.0"
   

Blue Team

Detection:

• Monitor for debug mode usage in DependencyCheck commands.
• Alert on log entries containing nvdApiKey= or apiKey= in plaintext.
• Use file integrity monitoring to detect unauthorized access to log files.

Prevention:

• Upgrade to DependencyCheck 9.0.7 or later.
• Avoid running DependencyCheck in debug mode in production or shared environments.
• Use environment variables for the API key and ensure they are not logged.
• Implement log redaction rules in your logging system (e.g., Logstash, Fluentd).

Indicators of Compromise (IOCs)

• Log Entry Pattern: nvdApiKey=[A-Za-z0-9-]+ or apiKey=[A-Za-z0-9-]+
• File: dependency-check.log containing the API key
• Network: Unusual NVD API requests from the compromised key (e.g., high volume, unexpected IPs)
• Process: DependencyCheck running with --debug flag

Detection Engineering

YARA Rule

rule CVE_2024_23686_NVD_API_Key_Leak {
    meta:
        description = "Detects NVD API Key leakage in DependencyCheck log files"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-23686"
    strings:
        $key1 = /nvdApiKey=[A-Za-z0-9-]{36,}/ nocase
        $key2 = /apiKey=[A-Za-z0-9-]{36,}/ nocase
    condition:
        any of them
}

Sigma Rule

title: NVD API Key Leakage in DependencyCheck Logs
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects plaintext NVD API Key in DependencyCheck debug logs
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23686
logsource:
    product: application
    service: dependencycheck
detection:
    selection:
        - EventID: 1
          CommandLine|contains: '--debug'
        - EventID: 2
          Data|contains: 'nvdApiKey='
    condition: selection
falsepositives:
    - Legitimate debug sessions with proper access controls
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-23686 NVD API Key Leakage"; flow:to_server; content:"nvdApiKey"; nocase; pcre:"/nvdApiKey=[A-Za-z0-9-]{36,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade to DependencyCheck 9.0.7 or later.
2. Rotate any exposed NVD API Keys immediately.
3. Review log files for any leaked keys and remove them.

Long-term:

• Implement log redaction for sensitive data (e.g., using Logstash filters or custom logback configurations).
• Use secrets management tools (e.g., HashiCorp Vault) to inject API keys at runtime.
• Restrict access to log files using file permissions and monitoring.
• Enable audit logging for access to log files.

Workaround:

• If upgrade is not possible, avoid using --debug flag in production. Use --info or --warn instead.

Valters IT