CVE-2024-10377
📋 TL;DR
This critical SQL injection vulnerability in ESAFENET CDG 5 allows remote attackers to execute arbitrary SQL commands by manipulating the 'id' parameter in the actionPassDecryptApplication1 function. Organizations using ESAFENET CDG 5 are affected, particularly those with internet-facing deployments. The vulnerability enables unauthorized database access and potential data manipulation.
💻 Affected Systems
- ESAFENET CDG 5
📦 What is this software?
Cdg by Esafenet
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via SQL injection escalation techniques.
Likely Case
Unauthorized data access, extraction of sensitive information, and potential privilege escalation within the application.
If Mitigated
Limited impact with proper input validation, parameterized queries, and network segmentation in place.
🎯 Exploit Status
Exploit details have been publicly disclosed. The vulnerability is remotely exploitable without authentication, making it attractive for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Vendor was contacted but did not respond. Consider workarounds or alternative solutions.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the /com/esafenet/servlet/client/DecryptApplicationService.java endpoint
Input Validation Filter
allAdd input validation to sanitize the 'id' parameter before processing
🧯 If You Can't Patch
- Isolate the ESAFENET CDG 5 system behind a firewall with strict network access controls
- Implement database-level protections: use least privilege accounts, enable SQL injection protection features
🔍 How to Verify
Check if Vulnerable:
Test the /com/esafenet/servlet/client/DecryptApplicationService.java endpoint with SQL injection payloads in the 'id' parameterCheck Version:
Check ESAFENET CDG 5 version through administrative interface or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and that parameterized queries are implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or parameter manipulation in application logs
- Requests to DecryptApplicationService.java with suspicious 'id' values
Network Indicators:
- Unusual outbound database connections from application server
- SQL error messages in HTTP responses
SIEM Query:
source="application_logs" AND ("DecryptApplicationService" OR "actionPassDecryptApplication1") AND ("id=" OR sql OR union OR select)