CVE-2024-10594
📋 TL;DR
This critical SQL injection vulnerability in ESAFENET CDG 5 allows remote attackers to execute arbitrary SQL commands by manipulating the fileId parameter in the docHistory function. Attackers can potentially access, modify, or delete database contents. All users of ESAFENET CDG 5 with the vulnerable component exposed are affected.
💻 Affected Systems
- ESAFENET CDG 5
📦 What is this software?
Cdg by Esafenet
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data destruction, privilege escalation to system-level access, and potential lateral movement to other systems.
Likely Case
Unauthorized data access and extraction, potential data modification or deletion, and possible application disruption.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
Exploit details have been publicly disclosed, making weaponization straightforward. The vulnerability requires no authentication and has simple exploitation vectors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: Yes
Instructions:
1. Contact ESAFENET for official patch or guidance. 2. If patch becomes available, apply following vendor instructions. 3. Restart application services after patching.
🔧 Temporary Workarounds
Web Application Firewall (WAF) Rules
allImplement WAF rules to block SQL injection patterns targeting the fileId parameter
Network Segmentation
allRestrict access to the vulnerable endpoint to trusted IP addresses only
🧯 If You Can't Patch
- Implement input validation and parameterized queries in the FileDirectoryService.java file
- Apply database-level controls: restrict application database user permissions to minimum required
🔍 How to Verify
Check if Vulnerable:
Test the /com/esafenet/servlet/fileManagement/FileDirectoryService endpoint with SQL injection payloads in the fileId parameterCheck Version:
Check ESAFENET CDG 5 version through application interface or configuration filesVerify Fix Applied:
Verify that SQL injection attempts no longer succeed and that parameterized queries are implemented📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed authentication attempts following SQL injection patterns
- Unexpected database error messages
Network Indicators:
- HTTP requests with SQL keywords in fileId parameter
- Unusual traffic patterns to the file management endpoint
SIEM Query:
source="application_logs" AND ("fileId" AND ("UNION" OR "SELECT" OR "INSERT" OR "DELETE" OR "DROP"))