CVE-2025-0787: Esafenet CDG V5 XSS Vulnerability

CVE-2025-0787 Overview

CVE-2025-0787 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in ESAFENET CDG V5, a data protection and document security product. The flaw resides in the /appDetail.jsp endpoint, where the curpage parameter is reflected into the response without proper sanitization. An authenticated remote attacker can craft a malicious URL that executes arbitrary JavaScript in the victim's browser session. The exploit details have been publicly disclosed. The vendor was contacted before disclosure but did not respond.

Critical Impact
Successful exploitation allows an attacker to inject and execute arbitrary script in the context of an authenticated CDG user, enabling session data theft, UI redress, and client-side action forgery.

Affected Products

ESAFENET CDG V5
Vulnerable component: /appDetail.jsp
Vulnerable parameter: curpage

Discovery Timeline

2025-01-28 - CVE-2025-0787 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0787

Vulnerability Analysis

The vulnerability is a reflected cross-site scripting flaw in the appDetail.jsp page of ESAFENET CDG V5. The application accepts the curpage request parameter and embeds its value into the rendered HTML response without applying output encoding or input validation. An attacker can supply script content through this parameter to have it executed in the browser of any user who follows a crafted link.

Exploitation requires network access to the application and low-privileged authentication, but no user interaction beyond visiting the crafted URL. Because the executed script runs within the origin of the CDG web interface, an attacker can read session cookies not marked HttpOnly, perform requests on behalf of the victim, and manipulate rendered content. The confidentiality impact is limited, but integrity of the client-side session context is affected.

The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Root Cause

The root cause is missing output encoding on the curpage parameter when it is reflected into the JSP-rendered page. The server-side template does not apply HTML-context escaping, allowing the raw parameter value to break out of the intended attribute or text context and introduce executable script.

Attack Vector

The attack vector is network-based via a crafted HTTP request to /appDetail.jsp with a malicious curpage value. A typical delivery method is phishing a CDG user with a URL that carries the payload, which then executes when the authenticated user opens the link. Public technical details are available in the GitHub Report Document and in the VulDB entry #293911.

No verified proof-of-concept code is republished here. Refer to the linked advisories for payload specifics.

Detection Methods for CVE-2025-0787

Indicators of Compromise

Web server access logs containing requests to /appDetail.jsp where the curpage parameter includes HTML tags, script fragments, or URL-encoded angle brackets (%3Cscript, %3Cimg).
Referer headers pointing to external domains preceding suspicious appDetail.jsp requests.
Unexpected outbound requests from user browsers to attacker-controlled hosts following CDG session activity.

Detection Strategies

Implement WAF signatures that inspect the curpage query parameter for script tags, event handlers (onerror=, onload=), and JavaScript URIs.
Enable server-side request logging with full query string capture and alert on parameter values exceeding expected length or containing HTML metacharacters.
Correlate authenticated CDG sessions with anomalous DOM-based network activity observed through browser telemetry.

Monitoring Recommendations

Baseline legitimate curpage values (typically numeric page identifiers) and alert on deviations.
Monitor for repeated /appDetail.jsp requests originating from the same source with varying encoded payloads, indicating XSS fuzzing.
Review CDG administrative session activity for unauthorized actions performed shortly after users open external links.

How to Mitigate CVE-2025-0787

Immediate Actions Required

Restrict access to the CDG management interface to trusted internal networks or VPN users only.
Deploy a web application firewall rule that blocks or sanitizes requests to /appDetail.jsp containing HTML or script metacharacters in curpage.
Ensure session cookies used by CDG are configured with HttpOnly and Secure flags to limit script-based cookie theft.

Patch Information

No vendor patch has been published at the time of writing. According to the disclosure, the vendor did not respond to pre-disclosure contact. Monitor the VulDB advisory and ESAFENET communications for future updates and apply any released fix promptly.

Workarounds

Add a reverse proxy filter that rejects requests to /appDetail.jsp when curpage is not strictly numeric.
Enforce a strong Content Security Policy (CSP) on CDG responses to block inline script execution.
Train CDG users to avoid clicking untrusted links that reference the internal CDG hostname.

bash

# Example nginx rule: allow only numeric curpage values on appDetail.jsp
location = /appDetail.jsp {
    if ($arg_curpage !~ "^[0-9]+$") {
        return 400;
    }
    proxy_pass http://cdg_backend;
}