CVE-2024-10070: Esafenet CDG SQL Injection Vulnerability

CVE-2024-10070 Overview

CVE-2024-10070 is a SQL injection vulnerability in ESAFENET CDG version 5. The flaw resides in the actionPolicyPush function within /com/esafenet/policy/action/PolicyPushControlAction.java. Attackers can manipulate the policyId parameter to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely over the network and requires only low-privilege authentication. Public disclosure of the exploit technique has occurred, increasing the likelihood of opportunistic attacks. The vendor was contacted before public disclosure but did not respond, leaving affected deployments without an official fix.

Critical Impact
Authenticated remote attackers can execute arbitrary SQL statements against the ESAFENET CDG database, enabling data disclosure, tampering, and potential downstream compromise of protected content.

Affected Products

ESAFENET CDG 5
/com/esafenet/policy/action/PolicyPushControlAction.java component
Deployments exposing the actionPolicyPush endpoint

Discovery Timeline

2024-10-17 - CVE-2024-10070 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10070

Vulnerability Analysis

The vulnerability is a classic SQL injection flaw [CWE-89] affecting the policy push workflow of ESAFENET CDG, a document security and data leakage prevention product. The actionPolicyPush handler in PolicyPushControlAction.java accepts a policyId argument from remote requests and incorporates that value into a SQL statement without adequate sanitization or parameterization. Because the endpoint is reachable over the network and requires only low-privilege credentials, an authenticated user can craft a malicious policyId value to alter the query's structure. Successful exploitation can expose confidential policy metadata, modify policy records, or pivot into other tables managed by the CDG backend.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command. The policyId parameter is concatenated directly into a dynamic SQL query rather than being bound as a parameter through a prepared statement. Any characters interpreted by the SQL parser, including quotes, comment sequences, and UNION clauses, become part of the executed query.

Attack Vector

Exploitation requires network access to the CDG management interface and a valid low-privilege account. The attacker submits a request to the policy push endpoint with a crafted policyId value containing SQL syntax. No user interaction is required. Because ESAFENET CDG stores sensitive data classification policies and encrypted document metadata, injected queries can be used to enumerate the schema, exfiltrate protected records, or corrupt policy state.

No verified proof-of-concept code has been published to a trusted repository. See the VulDB entry #280719 and the Flowus disclosure resource for the disclosed exploitation details.

Detection Methods for CVE-2024-10070

Indicators of Compromise

HTTP requests to policy push endpoints containing SQL metacharacters in the policyId parameter, such as single quotes, --, /*, UNION SELECT, or SLEEP(.
Database error messages or unexpected 500 responses returned by the CDG application following requests referencing actionPolicyPush.
Anomalous outbound query volume or long-running queries originating from the CDG application database user.

Detection Strategies

Deploy web application firewall signatures that inspect the policyId parameter on requests targeting PolicyPushControlAction for SQL injection patterns.
Enable database audit logging on the CDG backend and alert on queries referencing sensitive tables that originate from the policy push code path.
Correlate authentication logs with subsequent policy push requests to identify low-privilege accounts issuing unusual policy-related traffic.

Monitoring Recommendations

Baseline normal policyId values (numeric identifiers) and alert on any non-numeric input reaching the endpoint.
Monitor for enumeration behavior such as sequential policyId variations with boolean-based payloads within short time windows.
Forward CDG application and database logs to a centralized analytics platform for retrospective hunting once patch guidance becomes available.

How to Mitigate CVE-2024-10070

Immediate Actions Required

Restrict network access to the ESAFENET CDG management interface to trusted administrative networks only.
Rotate credentials for all low-privilege CDG accounts and audit account provisioning to remove unused users.
Enable database-layer logging and review historical requests targeting actionPolicyPush for signs of prior exploitation.
Place the CDG application behind a web application firewall configured to block SQL injection payloads.

Patch Information

The vendor was contacted prior to public disclosure but did not respond, and no official patch is currently referenced in the NVD advisory. Administrators should track vendor communications from ESAFENET for future updates and apply any released fixes immediately. Refer to the VulDB advisory #280719 for ongoing updates.

Workarounds

Enforce strict input validation at a reverse proxy or WAF, allowing only numeric values for the policyId parameter.
Limit database permissions granted to the CDG application account so that injected queries cannot read or modify tables outside the minimum required scope.
If the policy push feature is not required, disable or block the PolicyPushControlAction endpoint at the reverse proxy until a vendor fix is available.

bash

# Example NGINX rule restricting policyId to numeric input
location ~* /policy/action/PolicyPushControlAction {
    if ($arg_policyId !~ "^[0-9]+$") {
        return 400;
    }
    proxy_pass http://cdg_backend;
}