CVE-2024-10069: Esafenet CDG SQLi Vulnerability

CVE-2024-10069 Overview

CVE-2024-10069 is a SQL injection vulnerability in ESAFENET CDG version 5. The flaw resides in the actionPassMainApplication function of /com/esafenet/servlet/client/MailDecryptApplicationService.java. Attackers manipulate the id parameter to inject arbitrary SQL statements into backend database queries. The vulnerability is remotely exploitable and requires only low-privileged authentication [CWE-89]. Public disclosure of the exploit technique has occurred, and the vendor did not respond to disclosure attempts, leaving no official patch available at the time of publication.

Critical Impact
Authenticated remote attackers can inject SQL commands through the id parameter, potentially exposing database contents, modifying records, or enabling further compromise of the ESAFENET CDG document security platform.

Affected Products

ESAFENET CDG 5
Component: MailDecryptApplicationService.java
Function: actionPassMainApplication

Discovery Timeline

2024-10-17 - CVE-2024-10069 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10069

Vulnerability Analysis

The vulnerability affects the ESAFENET CDG (China Data Governance) document security platform. The actionPassMainApplication method in MailDecryptApplicationService.java handles requests related to mail decryption application approvals. The method accepts an id parameter from client input and incorporates it into a SQL query without proper parameterization or input sanitization.

An authenticated attacker with low privileges submits crafted values in the id argument to alter query semantics. This allows extraction of arbitrary database contents, modification of records, or manipulation of application logic tied to mail decryption workflows. The exploit technique has been publicly disclosed via VulDB submission #419869.

Root Cause

The root cause is improper neutralization of special elements used in SQL commands [CWE-89]. The id parameter is concatenated directly into a database query string rather than bound as a parameterized statement. Any input containing SQL metacharacters such as single quotes, semicolons, or UNION keywords is interpreted as query syntax by the backend database engine.

Attack Vector

Exploitation occurs over the network against the servlet endpoint exposed by the CDG application. The attacker requires a valid low-privileged session to reach the vulnerable servlet path. Once authenticated, the attacker sends an HTTP request targeting the client servlet route associated with MailDecryptApplicationService and supplies a malicious id value. The vulnerability manifests during query execution against the underlying relational database. Refer to the VulDB entry #280718 and the public disclosure resource for further technical detail.

Detection Methods for CVE-2024-10069

Indicators of Compromise

HTTP requests to servlet paths referencing MailDecryptApplicationService or actionPassMainApplication with SQL metacharacters in the id parameter.
Web server or application logs containing id= values with UNION SELECT, SLEEP(, --, ';, or hex-encoded SQL fragments.
Unexpected database error messages or stack traces referencing MailDecryptApplicationService in application logs.
Anomalous query volume or duration against tables associated with mail decryption workflows.

Detection Strategies

Deploy web application firewall (WAF) rules that flag SQL injection payloads directed at /com/esafenet/servlet/client/ endpoints.
Correlate authentication events with subsequent access to MailDecryptApplicationService from the same session to identify low-privilege reconnaissance.
Enable database audit logging for the CDG service account and alert on queries containing tautologies or union-based extraction patterns.

Monitoring Recommendations

Baseline normal request patterns to the CDG servlet layer and alert on statistical deviations in parameter length or character distribution.
Forward CDG application logs and database audit logs to a centralized analytics platform for retention and correlation.
Monitor outbound connections from the CDG application server for signs of data staging following successful injection.

How to Mitigate CVE-2024-10069

Immediate Actions Required

Restrict network access to the ESAFENET CDG application to trusted management networks and VPN users only.
Revoke or rotate credentials for low-privileged accounts that no longer require access to the CDG platform.
Apply WAF signatures blocking SQL injection payloads targeting the id parameter on the vulnerable servlet path.
Enable verbose query logging on the CDG database instance to support forensic review.

Patch Information

No vendor patch is available. The reporter states the vendor was contacted early about this disclosure but did not respond. Organizations running ESAFENET CDG 5 should track vendor communications directly and evaluate compensating controls until an official fix is released.

Workarounds

Place the CDG application behind a reverse proxy configured with SQL injection filtering rules for the id parameter.
Apply least-privilege configuration to the database account used by CDG, removing rights to unrelated tables and system procedures.
If mail decryption approval workflows are not actively used, disable or firewall the associated servlet endpoints.
Consider isolating the CDG server on a dedicated network segment with strict egress controls to limit post-exploitation impact.

bash

# Example WAF rule (ModSecurity) blocking SQLi payloads on the vulnerable endpoint
SecRule REQUEST_URI "@contains /com/esafenet/servlet/client/MailDecryptApplicationService" \
    "chain,phase:2,deny,status:403,id:1000069,msg:'Block SQLi attempt on CVE-2024-10069'"
    SecRule ARGS:id "@rx (?i)(union(\s|/\*.*\*/)+select|sleep\s*\(|--|;|'|\bor\b\s+1=1)" \
        "t:none,t:urlDecodeUni"