CVE-2024-10379
📋 TL;DR
This CVE describes a path traversal vulnerability in ESAFENET CDG 5 that allows attackers to read arbitrary files on the server by manipulating the decryptFileId parameter. The vulnerability affects systems running ESAFENET CDG 5 with the vulnerable DecryptApplicationService component exposed. Attackers can exploit this remotely without authentication to access sensitive system files.
💻 Affected Systems
- ESAFENET CDG
📦 What is this software?
Cdg by Esafenet
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read critical system files like /etc/passwd, /etc/shadow, Windows SAM files, or configuration files containing credentials, potentially leading to full system compromise.
Likely Case
Attackers will read sensitive configuration files, application data, or system files to gather information for further attacks or data exfiltration.
If Mitigated
With proper file permissions and network segmentation, impact is limited to files accessible by the application service account.
🎯 Exploit Status
Exploit details have been publicly disclosed showing how to use path traversal sequences like ../../../ to access arbitrary files. The vulnerability is simple to exploit with basic HTTP requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available - vendor did not respond to disclosure
Restart Required: Yes
Instructions:
1. Contact ESAFENET for official patch or guidance. 2. If no patch available, implement workarounds. 3. Monitor vendor communications for updates. 4. Consider upgrading to a newer version if available.
🔧 Temporary Workarounds
Input Validation Filter
allImplement input validation to reject path traversal sequences in the decryptFileId parameter
Add validation in DecryptApplicationService.java to check for '../' sequences and reject malicious input
Web Application Firewall Rule
allBlock requests containing path traversal patterns in the URL parameters
WAF rule to block: *../* in request parameters
ModSecurity rule: SecRule ARGS "@contains ../" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Implement network segmentation to restrict access to the vulnerable service only to trusted networks
- Apply strict file system permissions to limit what files the application service account can read
🔍 How to Verify
Check if Vulnerable:
Send HTTP request to DecryptApplicationService endpoint with parameter decryptFileId=../../../etc/passwd and check if file contents are returnedCheck Version:
Check application version through admin interface or configuration files. Exact command depends on deployment method.Verify Fix Applied:
Test with same path traversal payloads and verify requests are rejected or return error instead of file contents📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' sequences in parameters
- Unusual file access patterns from the application service
- Failed file access attempts to system directories
Network Indicators:
- HTTP requests with path traversal patterns in URL parameters
- Unusual outbound data transfers following file read attempts
SIEM Query:
source="web_server_logs" AND (url="*../*" OR parameters="*../*") AND dest_port="application_port"