CVE-2024-10072: Esafenet CDG SQL Injection Vulnerability

CVE-2024-10072 Overview

CVE-2024-10072 is a SQL injection vulnerability in ESAFENET CDG 5, a data leak prevention product. The flaw resides in the actionAddEncryptPolicyGroup function of /com/esafenet/servlet/policy/EncryptPolicyService.java. Manipulation of the checklist argument allows an authenticated remote attacker to inject arbitrary SQL statements. The issue is tracked under CWE-89. The exploit has been publicly disclosed, and the vendor did not respond to the disclosure attempt.

Critical Impact
Remote attackers with low privileges can inject SQL statements through the checklist parameter, potentially exposing or altering data managed by the ESAFENET CDG platform.

Affected Products

ESAFENET CDG 5
Component: com.esafenet.servlet.policy.EncryptPolicyService
Function: actionAddEncryptPolicyGroup

Discovery Timeline

2024-10-17 - CVE-2024-10072 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10072

Vulnerability Analysis

The vulnerability affects the actionAddEncryptPolicyGroup method in the EncryptPolicyService servlet. The method processes the checklist HTTP parameter and passes it into a database query without proper sanitization or parameterization. An authenticated attacker can supply crafted SQL syntax through this parameter to alter the intended query logic.

Because the servlet is reachable over the network, exploitation does not require local access. The attack requires only low-level authentication to the application. Successful exploitation can lead to disclosure of policy data, modification of encryption policy groups, or broader database compromise depending on the privileges of the backend database account.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The checklist argument passed to actionAddEncryptPolicyGroup is concatenated into a SQL statement rather than bound as a parameterized value. Any input containing SQL metacharacters is interpreted by the database engine as part of the query.

Attack Vector

Exploitation is performed remotely over HTTP against the ESAFENET CDG web interface. The attacker submits a request invoking EncryptPolicyService.actionAddEncryptPolicyGroup with a malicious checklist value containing SQL syntax. Public disclosure references are available through VulDB entry 280721 and the Flowus technical write-up.

No verified proof-of-concept code is included here. Refer to the linked disclosure for technical payload details.

Detection Methods for CVE-2024-10072

Indicators of Compromise

HTTP requests to EncryptPolicyService endpoints containing SQL metacharacters such as ', --, UNION, or SLEEP( in the checklist parameter.
Unexpected database errors or long response times generated by requests to actionAddEncryptPolicyGroup.
New or modified encryption policy groups that do not correspond to legitimate administrative activity.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect POST/GET parameters submitted to the ESAFENET CDG policy servlet for SQL injection patterns.
Enable database query logging and alert on syntactically anomalous statements originating from the CDG application account.
Correlate authenticated CDG session activity with database audit logs to identify parameter tampering.

Monitoring Recommendations

Monitor authentication logs for low-privileged accounts issuing repeated requests to /com/esafenet/servlet/policy/EncryptPolicyService.
Track outbound connections from the CDG application server that could indicate data exfiltration following successful injection.
Baseline normal policy management traffic and alert on volume or timing anomalies.

How to Mitigate CVE-2024-10072

Immediate Actions Required

Restrict network access to the ESAFENET CDG management interface to trusted administrative networks only.
Review accounts that can authenticate to the CDG application and disable unused or shared credentials.
Audit encryption policy group records for unauthorized additions or modifications.

Patch Information

No vendor patch or advisory is available. According to the CVE record, the vendor was contacted early but did not respond. Organizations running ESAFENET CDG 5 should treat this deployment as unpatched and apply compensating controls. Monitor VulDB entry 280721 for updates.

Workarounds

Place the CDG application behind a WAF configured with SQL injection signatures targeting the checklist parameter and other policy-service inputs.
Enforce least privilege on the database account used by CDG so that a successful injection cannot access unrelated schemas or execute administrative statements.
Isolate the CDG server in a segmented network zone and require VPN or bastion access for administrative use.
Consider suspending use of the affected functionality until a vendor fix is released.

bash

# Example WAF rule concept (ModSecurity syntax)
SecRule ARGS:checklist "@detectSQLi" \
    "id:1002401,phase:2,deny,status:403,\
    msg:'Possible CVE-2024-10072 SQLi against ESAFENET CDG EncryptPolicyService'"