CVE-2024-10278: Esafenet CDG SQL Injection Vulnerability

CVE-2024-10278 Overview

CVE-2024-10278 is a SQL injection vulnerability in ESAFENET CDG 5, a Chinese data protection and document security platform. The flaw resides in the /com/esafenet/servlet/user/ReUserOrganiseService.java component, where the userId parameter is incorporated into a database query without proper sanitization. Remote attackers with low privileges can manipulate the userId argument to inject arbitrary SQL statements. The exploit has been publicly disclosed, increasing the likelihood of opportunistic attacks. According to the VulDB report, the vendor was contacted before public disclosure but did not respond.

Critical Impact

Authenticated remote attackers can inject SQL queries through the userId parameter, potentially exposing or modifying data stored in the ESAFENET CDG backend database.

Affected Products

• ESAFENET CDG 5
• Component: ReUserOrganiseService.java within the user servlet path
• Deployments exposing the affected servlet endpoint to network-reachable clients

Discovery Timeline

• 2024-10-23 - CVE-2024-10278 published to NVD
• 2024-11-04 - Last updated in NVD database

Technical Details for CVE-2024-10278

Vulnerability Analysis

The vulnerability is classified as SQL Injection [CWE-89]. The affected servlet ReUserOrganiseService.java handles user organization operations within ESAFENET CDG. The userId request parameter is concatenated into a SQL statement rather than passed through a parameterized query or prepared statement.

An authenticated attacker can submit crafted input in userId to alter query logic. Successful exploitation may permit data extraction, authentication context manipulation, or modification of stored records. The attack is reachable over the network and requires low attack complexity. Public disclosure of the exploit details raises the risk of automated scanning and exploitation against exposed deployments.

Root Cause

The root cause is the absence of input validation and parameterized query construction in the ReUserOrganiseService.java servlet. User-controlled input from the userId HTTP parameter flows directly into a dynamically built SQL statement, allowing query structure to be altered by attacker payloads.

Attack Vector

The attack vector is network-based. An attacker authenticated to the application sends an HTTP request to the vulnerable servlet endpoint with a malicious userId value. Because the vulnerable component is reachable from any authenticated session, lateral movement after initial credential compromise becomes a realistic exploitation path. No user interaction is required.

No verified proof-of-concept code is included here. Refer to the VulDB Report #281553 and the Flowus Security Share for technical details published with the disclosure.

Detection Methods for CVE-2024-10278

Indicators of Compromise

• HTTP requests to URLs containing ReUserOrganiseService with anomalous userId parameter values, such as SQL meta-characters (', --, ;, UNION, SELECT).
• Database error responses or unusually large response payloads from the ESAFENET CDG application server.
• Unexpected SELECT, UNION, or information_schema queries originating from the CDG service account in database audit logs.

Detection Strategies

• Deploy web application firewall (WAF) rules to flag SQL injection patterns in requests targeting /com/esafenet/servlet/user/ paths.
• Inspect application access logs for repeated requests to ReUserOrganiseService from a single source within short time windows.
• Correlate authentication events with subsequent database query anomalies to identify post-login exploitation attempts.

Monitoring Recommendations

• Enable verbose query logging on the database backing ESAFENET CDG and alert on schema enumeration queries.
• Monitor outbound traffic from the CDG server for unexpected data egress that could indicate exfiltration.
• Baseline normal userId parameter values to detect deviations such as non-numeric or oversized inputs.

How to Mitigate CVE-2024-10278

Immediate Actions Required

• Restrict network access to the ESAFENET CDG application to trusted internal segments and VPN users only.
• Rotate credentials for any accounts that interact with the vulnerable servlet and audit existing sessions.
• Place a WAF in front of ESAFENET CDG with SQL injection signatures tuned for the userId parameter.

Patch Information

No vendor patch is referenced in the available CVE data. According to the disclosure, the vendor did not respond to outreach. Operators should monitor the VulDB advisory for vendor updates and apply any future security releases issued by Esafenet.

Workarounds

• Block or restrict requests to /com/esafenet/servlet/user/ReUserOrganiseService at the reverse proxy or WAF layer until a vendor fix is available.
• Apply database-level least privilege so the CDG application account cannot read sensitive tables or execute administrative statements.
• Enable database query allowlisting or stored procedure enforcement to limit the impact of injected SQL.

# Example nginx rule to block suspicious userId values reaching the vulnerable servlet
location /com/esafenet/servlet/user/ReUserOrganiseService {
    if ($arg_userId ~* "('|--|;|union|select|sleep|benchmark)") {
        return 403;
    }
    proxy_pass http://esafenet_backend;
}