CVE-2024-10134 Overview
CVE-2024-10134 is a SQL injection vulnerability affecting ESAFENET CDG version 5. The flaw resides in the connectLogout function of the /com/esafenet/servlet/ajax/MultiServerAjax.java file. Attackers can manipulate the servername argument to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely and requires low-level privileges but no user interaction. Public disclosure of exploit details has occurred, increasing risk of opportunistic attacks. The vendor was contacted prior to disclosure but did not respond, leaving the issue unpatched at the time of publication.
Critical Impact
Authenticated remote attackers can inject SQL statements through the servername parameter, potentially accessing or modifying sensitive data managed by ESAFENET CDG 5.
Affected Products
- ESAFENET CDG 5
- /com/esafenet/servlet/ajax/MultiServerAjax.java component
- Deployments exposing the connectLogout endpoint to network-reachable users
Discovery Timeline
- 2024-10-19 - CVE-2024-10134 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10134
Vulnerability Analysis
CVE-2024-10134 is a SQL Injection vulnerability [CWE-89] within ESAFENET CDG 5, a data governance and encryption product. The defect exists in the connectLogout function inside MultiServerAjax.java, which accepts a user-controlled servername parameter. The application concatenates this value into a SQL statement without parameterization or input sanitization. An attacker with valid low-privilege credentials can send crafted requests that alter the intended query logic. Successful exploitation allows reading, modifying, or deleting records within the underlying database. The vendor did not respond to disclosure attempts, and no official patch is available at the time of publication.
Root Cause
The root cause is improper neutralization of special elements used in a SQL command. The connectLogout handler concatenates the servername request parameter directly into a SQL query string. This lack of prepared statements or parameter binding allows attacker-controlled input to modify query semantics.
Attack Vector
The attack vector is network-based. An authenticated user sends a crafted HTTP request to the MultiServerAjax endpoint with a malicious payload in the servername field. The injected SQL is executed by the backend database with the privileges of the application service account. Public exploit details have been disclosed through third-party vulnerability databases.
The vulnerability manifests in the connectLogout handler where the servername request parameter flows into a SQL statement without sanitization. See the Flowus Security Sharing and VulDB entry #280922 for technical exploitation details.
Detection Methods for CVE-2024-10134
Indicators of Compromise
- HTTP requests to /com/esafenet/servlet/ajax/MultiServerAjax containing SQL metacharacters such as single quotes, UNION, SELECT, --, or /* within the servername parameter.
- Unexpected database errors or malformed query logs originating from the CDG application service account.
- Anomalous outbound data volumes from the CDG database host correlated with MultiServerAjax request bursts.
Detection Strategies
- Deploy web application firewall (WAF) signatures that inspect the servername parameter for SQL injection patterns targeting MultiServerAjax endpoints.
- Enable verbose application logging on the CDG server and alert on HTTP 500 responses tied to the connectLogout handler.
- Correlate authentication events with subsequent MultiServerAjax requests to identify low-privilege accounts probing the endpoint.
Monitoring Recommendations
- Monitor database audit logs for unexpected queries such as UNION SELECT, INFORMATION_SCHEMA enumeration, or time-based blind injection functions (SLEEP, BENCHMARK).
- Alert on repeated failed requests to MultiServerAjax from a single source IP within short time windows.
- Track privilege usage of the CDG application database account and flag deviations from baseline query patterns.
How to Mitigate CVE-2024-10134
Immediate Actions Required
- Restrict network access to the ESAFENET CDG 5 management interface using firewall rules or VPN gating until a vendor patch is released.
- Enforce strong authentication and revoke unnecessary low-privilege accounts that could reach the MultiServerAjax endpoint.
- Review database and application logs for prior exploitation attempts targeting the servername parameter.
Patch Information
No vendor patch is available. According to the disclosure, ESAFENET was contacted early but did not respond. Organizations should track vendor communications and apply an official fix as soon as it is published. Refer to the VulDB advisory for updated status.
Workarounds
- Deploy a WAF rule to block requests containing SQL metacharacters in the servername parameter of MultiServerAjax requests.
- Place the CDG application behind a reverse proxy that enforces strict input validation and drops malformed payloads.
- Apply least-privilege permissions to the CDG database account, disallowing schema modification and access to non-CDG databases.
- If the multi-server logout feature is unused, disable or block the /com/esafenet/servlet/ajax/MultiServerAjax route at the application server or proxy layer.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
