CVE-2024-10502: Esafenet CDG SQL Injection Vulnerability

CVE-2024-10502 Overview

CVE-2024-10502 is a SQL injection vulnerability in ESAFENET CDG 5, a document security and data leak prevention product. The flaw resides in the getOneFileDirectory function within /com/esafenet/servlet/fileManagement/FileDirectoryService.java. Attackers can manipulate the directoryId parameter to inject arbitrary SQL statements. The attack is remotely exploitable and requires low-privilege authentication. Public disclosure includes exploit details, and the vendor did not respond to disclosure attempts. The vulnerability is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

Critical Impact
Authenticated remote attackers can inject SQL statements through the directoryId parameter, potentially exposing or altering data stored in the ESAFENET CDG backend database.

Affected Products

ESAFENET CDG 5
File path: /com/esafenet/servlet/fileManagement/FileDirectoryService.java
Function: getOneFileDirectory

Discovery Timeline

2024-10-30 - CVE-2024-10502 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10502

Vulnerability Analysis

The vulnerability affects the getOneFileDirectory function inside FileDirectoryService.java. This Java servlet accepts a directoryId request parameter and incorporates it into a SQL query without proper parameterization or input sanitization. An authenticated attacker can supply crafted SQL syntax through directoryId to alter the executed query.

Successful exploitation lets attackers read data from tables outside their intended scope, bypass application-level filters, or modify stored records. Because the servlet is reachable over the network, exploitation can be initiated remotely against exposed ESAFENET CDG deployments. The exploit has been disclosed publicly through VulDB and Flowus, raising the likelihood of opportunistic exploitation attempts.

Root Cause

The root cause is direct concatenation of untrusted input into a SQL statement. The directoryId parameter is treated as a trusted value rather than being bound as a parameter through prepared statements. Standard defensive controls such as input validation, type enforcement, and use of PreparedStatement with parameter binding are absent for this code path.

Attack Vector

Exploitation requires network access to the ESAFENET CDG web interface and a low-privilege authenticated session. The attacker submits an HTTP request to the FileDirectoryService endpoint with a malicious directoryId value containing SQL syntax such as boolean-based, union-based, or time-based injection payloads. The backend database processes the concatenated statement, returning data or performing operations chosen by the attacker.

No verified exploit code has been published by SentinelLabs. See the VulDB entry #282442 and the Flowus disclosure for public technical details.

Detection Methods for CVE-2024-10502

Indicators of Compromise

HTTP requests to /com/esafenet/servlet/fileManagement/FileDirectoryService containing SQL metacharacters such as ', --, UNION, SLEEP(, or SELECT inside the directoryId parameter.
Database query logs showing malformed or unusually long queries originating from the getOneFileDirectory code path.
Application error responses tied to SQL syntax exceptions returned to authenticated user sessions.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the directoryId parameter for SQL keywords and metacharacters.
Enable verbose logging on the ESAFENET CDG application layer and correlate HTTP requests with database query logs.
Hunt for repeated 500-series responses or long response times against the FileDirectoryService endpoint, which can indicate blind or time-based SQL injection attempts.

Monitoring Recommendations

Forward web server, application, and database logs to a centralized analytics platform for correlation and retention.
Alert on authenticated sessions issuing unusual numbers of requests to file directory endpoints in short time windows.
Baseline normal parameter values for directoryId and flag deviations that include non-numeric or oversized inputs.

How to Mitigate CVE-2024-10502

Immediate Actions Required

Restrict network exposure of ESAFENET CDG 5 web interfaces to trusted management networks or VPN-only access.
Review authenticated user accounts and remove or disable unused low-privilege accounts that could be leveraged for exploitation.
Enable WAF signatures for SQL injection targeting the FileDirectoryService endpoint and the directoryId parameter.

Patch Information

No vendor patch has been published. The disclosure record notes the vendor was contacted early but did not respond. Organizations running ESAFENET CDG 5 should monitor the VulDB advisory for any subsequent vendor guidance and consider compensating controls until a fix is available.

Workarounds

Place ESAFENET CDG behind a reverse proxy that enforces strict parameter validation for directoryId, permitting only numeric values.
Apply database-layer least privilege so the ESAFENET CDG service account cannot read tables or execute statements outside its required scope.
Enable query logging and rate limiting on the database to detect and slow injection attempts.
If business requirements allow, take the affected module offline until a vendor patch is released.

bash

# Example nginx location block enforcing numeric-only directoryId
location /com/esafenet/servlet/fileManagement/FileDirectoryService {
    if ($arg_directoryId !~ "^[0-9]+$") {
        return 400;
    }
    proxy_pass http://esafenet_backend;
}