CVE-2024-10613 Overview
CVE-2024-10613 is a SQL injection vulnerability in ESAFENET CDG 5, a data leakage prevention product. The flaw resides in the delSystemEncryptPolicy function of /com/esafenet/servlet/system/SystemEncryptPolicyService.java. Attackers manipulate the id parameter to inject arbitrary SQL statements. The issue is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). Exploitation requires network access and low-privilege authentication, but no user interaction. The exploit details have been publicly disclosed. The vendor was contacted before publication but did not respond.
Critical Impact
Authenticated remote attackers can inject SQL through the id parameter of the delSystemEncryptPolicy endpoint, potentially reading or altering database contents in ESAFENET CDG 5.
Affected Products
- ESAFENET CDG 5
- Component: /com/esafenet/servlet/system/SystemEncryptPolicyService.java
- Vulnerable function: delSystemEncryptPolicy
Discovery Timeline
- 2024-11-01 - CVE-2024-10613 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10613
Vulnerability Analysis
The vulnerability is a classic SQL injection issue in a Java servlet. The delSystemEncryptPolicy method accepts an id argument from HTTP request parameters. This argument is concatenated into a SQL statement without parameterization or input sanitization. An authenticated attacker can supply crafted input in the id parameter to break out of the intended query context. The database then executes attacker-supplied SQL clauses alongside the original delete operation.
The exploit has been disclosed publicly, increasing the likelihood of opportunistic attacks against exposed ESAFENET CDG 5 deployments. The vendor did not respond to disclosure attempts, so no coordinated patch communication exists. Impacts include unauthorized data disclosure, tampering with encryption policy records, and potential lateral movement inside backend databases.
Root Cause
The root cause is direct string concatenation of untrusted input into a SQL query inside SystemEncryptPolicyService.java. The delSystemEncryptPolicy handler does not use prepared statements or bind parameters for the id value. Any special SQL characters passed by the client are interpreted by the database engine.
Attack Vector
Exploitation is remote over the network. An attacker with a valid low-privilege session sends an HTTP request to the delSystemEncryptPolicy endpoint with a malicious id payload. The payload can include UNION-based extraction, boolean-based inference, or stacked queries depending on the underlying database driver configuration. See the VulDB entry #282625 and the FlowUs technical writeup for reproduction details.
Detection Methods for CVE-2024-10613
Indicators of Compromise
- HTTP requests to /com/esafenet/servlet/system/SystemEncryptPolicyService containing SQL metacharacters such as ', --, UNION, or SLEEP( in the id parameter.
- Database error responses or unusually long response times tied to requests against the delSystemEncryptPolicy action.
- Unexpected deletions or modifications in the ESAFENET encryption policy tables.
Detection Strategies
- Deploy web application firewall signatures for SQL injection targeting the id parameter of ESAFENET CDG servlet paths.
- Enable database query logging and alert on non-parameterized queries originating from the CDG application service account.
- Correlate authentication logs with policy-service API calls to identify low-privilege accounts probing administrative endpoints.
Monitoring Recommendations
- Monitor outbound database connections from the CDG application server for anomalous query volume or schema enumeration patterns.
- Alert on repeated failed or malformed requests to SystemEncryptPolicyService from the same source IP.
- Retain application and access logs for the CDG servlet container to support forensic review.
How to Mitigate CVE-2024-10613
Immediate Actions Required
- Restrict network exposure of ESAFENET CDG 5 management interfaces to trusted administrative networks only.
- Rotate credentials for all low-privilege accounts that can authenticate to the CDG application.
- Audit the encryption policy tables and application logs for signs of tampering or unauthorized deletions.
Patch Information
No vendor patch has been published. Esafenet did not respond to the disclosure. Track the VulDB entry for updates and contact the vendor directly to request a fix for the delSystemEncryptPolicy function.
Workarounds
- Place the CDG application behind a WAF configured to block SQL injection payloads on the id parameter.
- Apply least-privilege on the database account used by CDG to limit the impact of successful injection.
- Disable or block access to the SystemEncryptPolicyService endpoint at the reverse proxy where feasible until a vendor fix is available.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
