CVE-2024-10133 Overview
CVE-2024-10133 is a SQL injection vulnerability affecting ESAFENET CDG version 5. The flaw resides in the updateNetSecPolicyPriority function within the file /com/esafenet/servlet/ajax/NetSecPolicyAjax.java. Attackers can manipulate the id or frontId parameters to inject arbitrary SQL statements. The vulnerability is exploitable remotely and requires only low-privilege authentication. Public disclosure has occurred, and the vendor was contacted before disclosure but did not respond. The weakness maps to [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).
Critical Impact
Authenticated remote attackers can inject SQL statements through the id and frontId parameters, potentially exposing or modifying data managed by the CDG data protection platform.
Affected Products
- ESAFENET CDG 5
- esafenet:cdg component: NetSecPolicyAjax.java
- Function: updateNetSecPolicyPriority
Discovery Timeline
- 2024-10-19 - CVE-2024-10133 published to the National Vulnerability Database
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-10133
Vulnerability Analysis
The vulnerability exists in the AJAX endpoint handled by NetSecPolicyAjax.java, specifically inside the updateNetSecPolicyPriority function. The function accepts user-controlled id and frontId request parameters and incorporates them into an SQL statement without proper sanitization or parameterized query use. An attacker submits crafted values for these parameters and alters the intended query structure. Because the affected endpoint is reachable over the network, exploitation does not require local access. The published exploit lowers the barrier for opportunistic attackers targeting exposed CDG deployments.
Root Cause
The root cause is improper neutralization of special SQL characters ([CWE-89]) when constructing the priority-update query. The id and frontId parameters are concatenated into the SQL string rather than bound as parameters. Any string containing SQL syntax passes through to the database driver unmodified.
Attack Vector
The attack vector is network-based. An authenticated user issues an HTTP request to the NetSecPolicyAjax endpoint invoking the updateNetSecPolicyPriority action with malicious payloads in id or frontId. The manipulated query can enumerate database contents through boolean-based or time-based blind techniques, and in some deployments extract records from tables holding policy metadata or credential material.
No verified proof-of-concept code is available. Technical details are referenced in the VulDB entry #280921 and the Flowus shared writeup.
Detection Methods for CVE-2024-10133
Indicators of Compromise
- HTTP requests to /com/esafenet/servlet/ajax/NetSecPolicyAjax containing SQL metacharacters such as single quotes, UNION, SELECT, SLEEP(, or comment sequences within id or frontId parameters.
- Database error responses or unusual response-time deltas correlated with requests targeting the updateNetSecPolicyPriority action.
- Unexpected policy priority changes in ESAFENET CDG audit logs without a corresponding administrator action.
Detection Strategies
- Deploy web application firewall rules that inspect id and frontId parameters for SQL syntax on the NetSecPolicyAjax route.
- Enable database query logging and alert on syntactically anomalous statements originating from the CDG application account.
- Correlate authentication events with SQL error frequencies to surface authenticated abuse patterns.
Monitoring Recommendations
- Baseline the normal volume of updateNetSecPolicyPriority calls per user and alert on statistical outliers.
- Monitor for outbound connections from the CDG database host, which may indicate post-exploitation data exfiltration.
- Review access logs for repeated 500-series responses tied to the vulnerable endpoint.
How to Mitigate CVE-2024-10133
Immediate Actions Required
- Restrict network access to the ESAFENET CDG management interface to trusted administrative subnets only.
- Review and revoke unnecessary user accounts that could be used to authenticate against the vulnerable endpoint.
- Enable verbose logging on the CDG application server and forward logs to a central SIEM for review.
Patch Information
The vendor was contacted before public disclosure but did not respond, and no official patch has been referenced in the advisories. Organizations running ESAFENET CDG 5 should contact ESAFENET directly for remediation guidance and monitor the VulDB entry for updates.
Workarounds
- Place a reverse proxy or WAF in front of the CDG server and block requests where id or frontId contain non-numeric characters.
- Enforce database-level least privilege so the CDG application account cannot read or modify tables outside its required scope.
- Isolate the CDG database on a dedicated host and disable outbound internet access from that host.
# Example WAF rule (ModSecurity syntax) restricting id/frontId to integers
SecRule ARGS:id "!@rx ^[0-9]+$" \
"id:1024133,phase:2,deny,status:400,\
msg:'CVE-2024-10133 - non-numeric id parameter blocked'"
SecRule ARGS:frontId "!@rx ^[0-9]+$" \
"id:1024134,phase:2,deny,status:400,\
msg:'CVE-2024-10133 - non-numeric frontId parameter blocked'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
