CVE-2024-10072
📋 TL;DR
This critical SQL injection vulnerability in ESAFENET CDG 5 allows remote attackers to execute arbitrary SQL commands by manipulating the 'checklist' parameter in the actionAddEncryptPolicyGroup function. Organizations using ESAFENET CDG 5 are affected, particularly those with internet-facing instances. The vulnerability could lead to data theft, system compromise, or complete database takeover.
💻 Affected Systems
- ESAFENET CDG 5
📦 What is this software?
Cdg by Esafenet
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, privilege escalation, and potential lateral movement to other systems.
Likely Case
Unauthorized data access, modification, or deletion of sensitive information in the database.
If Mitigated
Limited impact if proper input validation and parameterized queries are implemented.
🎯 Exploit Status
Exploit details have been publicly disclosed, making weaponization likely. The vulnerability requires remote access but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Vendor has not responded to disclosure. Consider workarounds or alternative solutions.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the /com/esafenet/servlet/policy/EncryptPolicyService.java endpoint
Network Segmentation
allRestrict network access to ESAFENET CDG 5 instances to only trusted IP addresses
🧯 If You Can't Patch
- Isolate the affected system from the internet and restrict internal network access
- Implement strict input validation and parameterized queries at the application layer if source code access is available
🔍 How to Verify
Check if Vulnerable:
Check if ESAFENET CDG 5 is installed and review application logs for SQL injection attempts against the EncryptPolicyService endpointCheck Version:
Check application documentation or configuration files for ESAFENET CDG 5 version informationVerify Fix Applied:
Test the vulnerable endpoint with SQL injection payloads to confirm they are properly blocked or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts or parameter manipulation in EncryptPolicyService logs
- SQL syntax errors in application error logs
Network Indicators:
- Unusual database connection patterns from application servers
- SQL injection patterns in HTTP requests to /com/esafenet/servlet/policy/EncryptPolicyService.java
SIEM Query:
source="application_logs" AND ("EncryptPolicyService" OR "actionAddEncryptPolicyGroup") AND (sql OR injection OR "UNION SELECT" OR "OR 1=1")