SteeltoeOSS versions before 4.3.0 have a vulnerability in the Steeltoe.Management.Endpoint /actuator/httpexchanges endpoint. While the MaskedUri function masks user information in URIs, it does not inspect or mask query string parameters. If the Management:Endpoints:HttpExchanges:IncludeQueryString setting is enabled, sensitive data contained in query strings from prior HTTP traffic can be disclosed to any caller able to access this endpoint. Furthermore, the DEBUG logger records these URIs, potentially exposing sensitive tokens and keys to users with log access. This vulnerability is addressed in SteeltoeOSS version 4.3.0.

An attacker who can access the /actuator/httpexchanges endpoint with IncludeQueryString enabled may obtain sensitive information such as OAuth tokens, password-reset tokens, signed-URL signatures, and API keys from previous HTTP requests. This exposure can lead to unauthorized access or misuse of these credentials. Additionally, sensitive data may be exposed through DEBUG logs accessible to users with log access privileges. The vulnerability does not affect system integrity or availability but compromises confidentiality.

This vulnerability is fixed in SteeltoeOSS version 4.3.0. Users should upgrade to version 4.3.0 or later to remediate the issue. If upgrading is not immediately possible, disabling the Management:Endpoints:HttpExchanges:IncludeQueryString setting will prevent query string data from being included in the endpoint response, mitigating the exposure. Review and restrict access to DEBUG logs to prevent sensitive data disclosure through logging.