CVE-2024-10611: Esafenet CDG SQL Injection Vulnerability

CVE-2024-10611 Overview

CVE-2024-10611 is a SQL injection vulnerability in ESAFENET CDG version 5. The flaw resides in the delProtocol function of /com/esafenet/servlet/system/PrintScreenListService.java. Attackers manipulate the id parameter to inject arbitrary SQL statements into backend database queries. The issue is classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command).

Remote attackers with low privileges can exploit this vulnerability across the network without user interaction. The exploit has been publicly disclosed. ESAFENET was contacted before disclosure but did not respond to the researchers.

Critical Impact

Authenticated remote attackers can execute arbitrary SQL statements against the ESAFENET CDG database, compromising the confidentiality and integrity of stored data.

Affected Products

• ESAFENET CDG 5
• Component: PrintScreenListService.java servlet
• Function: delProtocol

Discovery Timeline

• 2024-11-01 - CVE-2024-10611 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10611

Vulnerability Analysis

The vulnerability affects the delProtocol function inside the PrintScreenListService servlet of ESAFENET CDG 5. This servlet handles print screen protocol records within the document security gateway product. The id request parameter flows directly into a SQL statement without proper sanitization or parameterization.

Because the parameter is concatenated into a database query, an attacker can append arbitrary SQL clauses. This exposes the underlying database to unauthorized read and write operations. The vulnerability is remotely reachable over the network and requires only low-privileged authentication.

ESAFENET CDG is deployed as an enterprise data leakage prevention and document encryption platform. Compromise of its backend database can expose sensitive policy configurations, audit logs, and user records.

Root Cause

The root cause is improper neutralization of user-supplied input inside a SQL statement [CWE-89]. The delProtocol handler accepts the id argument from an HTTP request and inserts it into a query string using string concatenation. No prepared statements, parameter binding, or allow-list validation are applied before the query executes.

Attack Vector

An attacker sends a crafted HTTP request to the PrintScreenListService endpoint with a malicious value in the id parameter. The injected payload alters the SQL query executed by the backend. Depending on database privileges, the attacker can enumerate tables, extract data, modify rows, or delete records.

Detailed proof-of-concept material is referenced through VulDB entry #282623 and a Flowus shared resource.

Detection Methods for CVE-2024-10611

Indicators of Compromise

• HTTP requests to /com/esafenet/servlet/system/PrintScreenListService containing SQL metacharacters such as single quotes, UNION, SLEEP, or comment sequences in the id parameter.
• Unexpected database errors or long query response times originating from the CDG application server.
• Anomalous outbound queries or data volumes from the CDG backend database.

Detection Strategies

• Deploy web application firewall rules that inspect the id parameter on PrintScreenListService endpoints for SQL injection patterns.
• Enable database query logging and alert on DELETE, UNION SELECT, or time-based payloads originating from the CDG application account.
• Correlate authentication logs with request patterns to identify low-privileged accounts probing administrative servlets.

Monitoring Recommendations

• Monitor access logs for repeated requests to PrintScreenListService from a single source with varying id values.
• Track database CPU spikes and slow queries during off-hours which may indicate blind SQL injection attempts.
• Review outbound network traffic from the CDG server for signs of data exfiltration following suspicious queries.

How to Mitigate CVE-2024-10611

Immediate Actions Required

• Restrict network access to the ESAFENET CDG management interface using firewall rules or reverse proxy allow-lists.
• Audit all accounts with access to the CDG application and revoke unused low-privileged credentials.
• Enable verbose logging on the application and database tiers to capture exploitation attempts.

Patch Information

No vendor patch is available at the time of publication. According to the disclosure, ESAFENET was contacted before public disclosure but did not respond. Organizations should track VulDB entry #282623 for updates and contact ESAFENET support directly for remediation guidance.

Workarounds

• Place the CDG application behind a web application firewall configured to block SQL injection payloads targeting the id parameter.
• Apply least-privilege principles to the database account used by CDG, removing DROP, ALTER, and cross-schema permissions where possible.
• Segment the CDG server on an isolated VLAN and require VPN or bastion host access for administrative users.
• Consider taking the affected functionality offline until a vendor fix is available.

# Example WAF rule (ModSecurity) blocking SQLi patterns on the vulnerable endpoint
SecRule REQUEST_URI "@contains /com/esafenet/servlet/system/PrintScreenListService" \
    "chain,phase:2,deny,status:403,id:1010611,msg:'CVE-2024-10611 SQLi attempt'"
    SecRule ARGS:id "@rx (?i)(union(\s|\+)+select|sleep\(|--|;|/\*|xp_)" "t:none"