CVE-2024-10610: Esafenet CDG SQL Injection Vulnerability

CVE-2024-10610 Overview

CVE-2024-10610 is a SQL injection vulnerability in ESAFENET CDG 5, a data-loss-prevention product. The flaw resides in the delProtocol function of /com/esafenet/servlet/system/ProtocolService.java. Attackers can manipulate the id parameter to inject arbitrary SQL statements into backend database queries. The issue is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command.

The attack is remotely exploitable and requires only low-privileged authentication. The exploit details were disclosed publicly. The vendor was contacted before disclosure but did not respond.

Critical Impact
Authenticated remote attackers can inject SQL commands through the id parameter of delProtocol, potentially exposing or modifying database contents in ESAFENET CDG 5.

Affected Products

ESAFENET CDG 5
Component: /com/esafenet/servlet/system/ProtocolService.java
Function: delProtocol

Discovery Timeline

2024-11-01 - CVE-2024-10610 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10610

Vulnerability Analysis

The vulnerability exists in the delProtocol handler within the ESAFENET CDG 5 server-side Java servlet layer. This handler accepts an id argument supplied over HTTP and passes it into a SQL statement without adequate sanitization or parameterization. An attacker who can authenticate to the application with low privileges can supply crafted input that alters the intended SQL query.

Successful exploitation can lead to unauthorized reading, modification, or deletion of database records. Because ESAFENET CDG manages document-security metadata and policy data, tampering with these records can undermine the confidentiality and integrity controls the product enforces. Exploitation does not require user interaction and can be automated across the network.

Root Cause

The root cause is direct concatenation of untrusted input into a SQL query in delProtocol. The code path does not use prepared statements or bind variables. Any input value substituted into the id parameter reaches the database engine intact, letting attackers break out of the intended query context.

Attack Vector

Exploitation occurs over the network against the ESAFENET CDG 5 web interface. The attacker submits a request to the ProtocolService endpoint that invokes delProtocol and appends SQL syntax to the id argument. Public disclosure references are available through VulDB entry #282622 and a Flowus write-up.

No verified proof-of-concept code is included here. Refer to the linked advisory references for parameter formats and request structures used in the disclosure.

Detection Methods for CVE-2024-10610

Indicators of Compromise

HTTP requests to ProtocolService endpoints containing SQL metacharacters such as single quotes, UNION, SELECT, --, or ; in the id parameter.
Unexpected database errors or stack traces referencing delProtocol in application logs.
Anomalous DELETE or SELECT statements against protocol-related tables outside normal administrative hours.

Detection Strategies

Deploy web application firewall rules that inspect requests to /com/esafenet/servlet/system/ProtocolService for SQL injection payload patterns in the id parameter.
Enable database query auditing to log parameterized versus dynamic SQL usage from the ESAFENET CDG application account.
Correlate authentication logs with subsequent delProtocol requests to identify low-privilege accounts probing administrative endpoints.

Monitoring Recommendations

Alert on repeated 500-series responses from ProtocolService handlers, which often indicate injection attempts triggering SQL errors.
Baseline normal id parameter values (numeric identifiers) and flag non-numeric or oversized inputs.
Monitor outbound network activity from the CDG database host for signs of data exfiltration following suspicious queries.

How to Mitigate CVE-2024-10610

Immediate Actions Required

Restrict network access to the ESAFENET CDG 5 administrative interface to trusted management networks only.
Rotate credentials for any low-privileged accounts that could reach the ProtocolService endpoint.
Review database and application logs for evidence of prior exploitation of the delProtocol handler.

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted about this issue but did not respond. Consult the VulDB advisory for updated remediation status.

Workarounds

Block or filter requests to the delProtocol endpoint at a reverse proxy or WAF until an official fix is released.
Enforce input validation at the perimeter, rejecting non-numeric id values before they reach the application server.
Apply least-privilege database permissions to the application account, limiting DELETE and administrative statements where possible.
Consider isolating the ESAFENET CDG 5 deployment behind a VPN or jump host to reduce remote attack surface.

bash

# Example WAF rule (ModSecurity) to block SQLi patterns targeting the vulnerable endpoint
SecRule REQUEST_URI "@contains /com/esafenet/servlet/system/ProtocolService" \
    "chain,id:1010610,phase:2,deny,status:403,msg:'Potential CVE-2024-10610 SQLi'"
    SecRule ARGS:id "@rx (?i)(union|select|--|;|'|\bor\b|\band\b)" "t:none"