CVE-2024-10135 Overview
CVE-2024-10135 is a SQL injection vulnerability in ESAFENET CDG version 5. The flaw resides in the actionDelNetSecConfig function of the file /com/esafenet/servlet/netSec/NetSecConfigService.java. Attackers can manipulate the id parameter to inject arbitrary SQL statements into backend database queries. The vulnerability is exploitable remotely and requires low privileges but no user interaction. Public disclosure of the exploit technique has occurred, increasing exposure risk. The vendor was contacted before public disclosure but did not respond, leaving affected deployments without an official patch.
Critical Impact
Remote authenticated attackers can execute arbitrary SQL against the ESAFENET CDG backend database, leading to data exposure, modification, or deletion [CWE-89].
Affected Products
- ESAFENET CDG 5
- Component: NetSecConfigService.java
- Function: actionDelNetSecConfig
Discovery Timeline
- 2024-10-19 - CVE-2024-10135 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10135
Vulnerability Analysis
The vulnerability is a classic SQL injection flaw [CWE-89] in the network security configuration deletion endpoint of ESAFENET CDG. The actionDelNetSecConfig function accepts an id argument from HTTP requests and concatenates it into a SQL statement without proper parameterization or input sanitization. Attackers with authenticated access can supply crafted values in the id parameter to alter the query logic. This enables extraction of database contents, unauthorized modification of records, or destructive operations against the underlying data store. Because ESAFENET CDG is used for document security and data leak prevention, compromise of its database undermines the confidentiality of the assets it is deployed to protect.
Root Cause
The root cause is direct concatenation of untrusted user input into a SQL query inside actionDelNetSecConfig. The application does not use prepared statements or parameterized queries and does not enforce type validation on the id argument before it reaches the database driver.
Attack Vector
An attacker sends a crafted HTTP request to the ESAFENET CDG servlet endpoint that invokes actionDelNetSecConfig, supplying a malicious payload in the id parameter. The attack is remote and requires low privileges. Successful exploitation yields SQL execution in the context of the application database user. Public exploit details have been disclosed through third-party vulnerability databases, lowering the barrier to weaponization.
No verified proof-of-concept code is included in this advisory. Refer to the VulDB entry #280923 for public technical details.
Detection Methods for CVE-2024-10135
Indicators of Compromise
- HTTP requests to NetSecConfigService endpoints containing SQL metacharacters such as single quotes, UNION, SLEEP, or -- in the id parameter.
- Unexpected DELETE, UNION SELECT, or time-based query patterns in database audit logs originating from the ESAFENET CDG application user.
- Anomalous outbound requests or extended response times from the CDG server correlating with actionDelNetSecConfig calls.
Detection Strategies
- Deploy web application firewall rules that inspect parameters submitted to /com/esafenet/servlet/netSec/NetSecConfigService for SQL injection signatures.
- Enable database query logging and alert on parameterized query violations, tautological expressions, or stacked queries from the CDG service account.
- Correlate application access logs with database logs to identify request-to-query patterns that deviate from normal id-based deletions.
Monitoring Recommendations
- Monitor authentication logs for compromised or brute-forced low-privilege accounts that could reach the vulnerable endpoint.
- Baseline normal traffic to NetSecConfigService and alert on volumetric anomalies or repeated 500-class responses.
- Track EPSS trends for CVE-2024-10135, currently reported at 0.572% (percentile 44.214) as of 2026-08-11, to reprioritize response as exploitation likelihood shifts.
How to Mitigate CVE-2024-10135
Immediate Actions Required
- Restrict network access to ESAFENET CDG administrative interfaces to trusted management networks only.
- Revoke or rotate credentials for any account that does not require access to the NetSecConfigService endpoint.
- Enable database activity monitoring on the CDG backend and alert on queries containing SQL injection indicators.
Patch Information
The vendor was contacted before public disclosure but did not respond, and no official patch has been published at the time of NVD posting. Consult the Flowus technical write-up and VulDB CTI entry for the latest fix status. Contact ESAFENET support directly to request a security update.
Workarounds
- Deploy a WAF rule that blocks or sanitizes non-numeric input to the id parameter on requests targeting NetSecConfigService.
- Place the CDG application behind a reverse proxy that enforces strict input validation and authenticated access controls.
- Reduce the privileges of the database account used by ESAFENET CDG so it cannot perform destructive or cross-schema operations.
# Example WAF rule (ModSecurity) to reject non-numeric id values to NetSecConfigService
SecRule REQUEST_URI "@contains /com/esafenet/servlet/netSec/NetSecConfigService" \
"chain,phase:2,deny,status:400,id:1024135,msg:'CVE-2024-10135 SQLi mitigation'"
SecRule ARGS:id "!@rx ^[0-9]+$" "t:none"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
