CVE-2024-10279: Esafenet CDG SQLi Vulnerability

CVE-2024-10279 Overview

CVE-2024-10279 is a SQL injection vulnerability in ESAFENET CDG 5, a document security and data leakage prevention product. The flaw resides in the /com/esafenet/servlet/policy/PrintPolicyService.java component. Manipulation of the policyId argument leads to SQL injection [CWE-89]. The vulnerability is remotely exploitable and requires low-privileged authentication. Public disclosure includes technical details, and the vendor did not respond to disclosure attempts.

Critical Impact

Authenticated remote attackers can inject arbitrary SQL through the policyId parameter, potentially exposing or modifying data managed by the ESAFENET CDG document security platform.

Affected Products

• ESAFENET CDG 5
• Component: PrintPolicyService.java under /com/esafenet/servlet/policy/
• Vendor: Esafenet (unresponsive to disclosure)

Discovery Timeline

• 2024-10-23 - CVE-2024-10279 published to NVD
• 2024-11-04 - Last updated in NVD database

Technical Details for CVE-2024-10279

Vulnerability Analysis

The vulnerability exists in the PrintPolicyService servlet shipped with ESAFENET CDG 5. The servlet accepts a policyId request parameter and uses it when constructing a database query. Because the parameter is concatenated into SQL rather than bound through a parameterized statement, an attacker can break out of the intended query context and append arbitrary SQL syntax.

Exploitation requires network access to the application and a valid low-privileged session, as reflected in the CVSS 4.0 vector. Successful injection can disclose policy data, alter print policy records, or pivot to broader database content depending on the privileges granted to the application's database account.

The vendor was contacted prior to public disclosure but did not respond. No official patch reference is published in the NVD entry. Public technical write-ups are linked from the Flowus security share and VulDB entry #281554.

Root Cause

The root cause is improper neutralization of special elements in an SQL command [CWE-89]. The policyId value flowing into PrintPolicyService.java is incorporated into a query string without prepared-statement binding or input validation. Any character set permitted in the HTTP parameter reaches the SQL parser unchanged.

Attack Vector

The attack vector is network-based. An attacker with a valid CDG session sends a crafted HTTP request to the print policy endpoint, supplying a malicious policyId value containing SQL metacharacters such as single quotes, UNION SELECT clauses, or stacked statements. EPSS data lists a current exploit probability of 0.097% (percentile 26.561), but public disclosure of the vector raises the risk of opportunistic scanning.

No verified proof-of-concept code is referenced in the NVD record. The vulnerability mechanism is described in prose; see the linked external references for any technical write-ups published by third parties.

Detection Methods for CVE-2024-10279

Indicators of Compromise

• HTTP requests to /com/esafenet/servlet/policy/PrintPolicyService containing SQL metacharacters such as ', --, ;, UNION, SELECT, or SLEEP( in the policyId parameter.
• Database error messages or unusually large response bodies returned from the PrintPolicyService endpoint.
• Repeated requests to the same endpoint from a single source with incrementally varying policyId values, indicative of automated injection tooling.

Detection Strategies

• Inspect web server and application logs for non-numeric or encoded payloads in the policyId parameter, since legitimate traffic typically supplies an integer identifier.
• Deploy web application firewall signatures that flag SQL injection patterns targeting ESAFENET CDG URL paths.
• Correlate authenticated user sessions with anomalous query volume or query latency against the CDG backend database.

Monitoring Recommendations

• Enable database audit logging for the CDG service account and alert on schema enumeration queries against information_schema or system catalog tables.
• Forward web access logs and database audit events into a centralized analytics platform for cross-source correlation of injection attempts.
• Monitor authentication logs for low-privileged accounts performing access patterns inconsistent with their role.

How to Mitigate CVE-2024-10279

Immediate Actions Required

• Restrict network exposure of the ESAFENET CDG 5 management interface to trusted administrative networks or VPN access only.
• Audit accounts with access to the print policy functionality and disable unused or shared low-privileged accounts.
• Review database privileges assigned to the CDG application account and reduce them to the minimum required for normal operation.
• Deploy WAF rules to block SQL metacharacters in the policyId parameter on requests to PrintPolicyService.

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2024-10279. The vendor did not respond to coordinated disclosure attempts. Organizations should contact Esafenet directly for remediation status and monitor the VulDB entry for updates.

Workarounds

• Place ESAFENET CDG 5 behind a reverse proxy or WAF configured to reject non-integer values for the policyId parameter.
• Apply database-level controls such as query whitelisting or stored-procedure-only access for the CDG service account where supported.
• If the print policy feature is not in active use, restrict access to the /com/esafenet/servlet/policy/ path at the proxy layer.

# Example nginx rule to reject non-numeric policyId values
location /com/esafenet/servlet/policy/PrintPolicyService {
    if ($arg_policyId !~ "^[0-9]+$") {
        return 400;
    }
    proxy_pass http://cdg_backend;
}