CVE-2025-0794: ESAFENET CDG V5 XSS Vulnerability

CVE-2025-0794 Overview

CVE-2025-0794 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in ESAFENET CDG V5, a data loss prevention product. The flaw resides in the /todoDetail.jsp endpoint, where the curpage parameter is rendered without adequate output encoding. An authenticated remote attacker can inject arbitrary script content that executes in the victim's browser session. The exploit details have been publicly disclosed, increasing exposure risk. The vendor was contacted before public disclosure but did not respond.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of an authenticated CDG user, enabling session theft, credential harvesting, or unauthorized actions performed as the victim.

Affected Products

ESAFENET CDG V5
ESAFENET CDG (cpe:2.3:a:esafenet:cdg:5:*:*:*:*:*:*:*)
Deployments exposing /todoDetail.jsp to authenticated users

Discovery Timeline

2025-01-29 - CVE-2025-0794 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0794

Vulnerability Analysis

The vulnerability is a classic reflected XSS issue in the todoDetail.jsp page of ESAFENET CDG V5. The curpage request parameter, used for pagination context, is echoed back into the HTML response without proper contextual output encoding. When a victim loads a crafted URL, the browser parses and executes the injected script as if it originated from the trusted application.

Because CDG is a data-classification and content-security product, sessions typically hold elevated administrative privileges. Successful exploitation can pivot to configuration tampering, policy manipulation, and exfiltration of authentication material. The attack requires low privileges and no user interaction beyond visiting the crafted link.

Root Cause

The root cause is missing or insufficient neutralization of user-supplied input during web page generation [CWE-79]. The curpage parameter flows from the HTTP request into the rendered response without HTML entity encoding or contextual escaping, allowing script tags and event handlers to break out of the intended data context.

Attack Vector

The vulnerability is exploitable over the network. An attacker crafts a URL to /todoDetail.jsp containing a malicious payload in the curpage parameter and delivers it to an authenticated CDG user via phishing, chat, or a watering-hole page. When the target's browser loads the response, the injected JavaScript executes in the CDG application origin, granting the attacker access to session cookies and DOM-level operations.

No verified proof-of-concept code is provided in the enriched data. Technical write-up details are available in the GitHub Report Document and the VulDB entry #293918.

Detection Methods for CVE-2025-0794

Indicators of Compromise

Requests to /todoDetail.jsp containing suspicious values in the curpage parameter, such as <script>, onerror=, javascript:, or URL-encoded variants like %3Cscript%3E.
Web server access logs showing abnormally long curpage values or non-numeric content where an integer is expected.
Outbound browser requests from CDG users to unfamiliar domains immediately after loading a todoDetail.jsp URL.

Detection Strategies

Deploy Web Application Firewall (WAF) rules that inspect the curpage parameter for HTML and JavaScript metacharacters.
Correlate proxy and endpoint telemetry to identify users who received links to /todoDetail.jsp from external senders.
Hunt for anomalous script execution originating from the CDG application domain in browser and DOM-monitoring telemetry.

Monitoring Recommendations

Alert on HTTP 200 responses from /todoDetail.jsp where the request query string contains reflected script fragments.
Monitor authenticated session activity for privilege changes or bulk data access that follow a suspicious todoDetail.jsp request.
Track email and messaging gateways for URLs referencing todoDetail.jsp on internal CDG hosts.

How to Mitigate CVE-2025-0794

Immediate Actions Required

Restrict access to the CDG management interface to trusted administrative networks or VPN segments.
Deploy WAF signatures that block requests to /todoDetail.jsp containing HTML, script, or event-handler payloads in the curpage parameter.
Instruct CDG administrators to avoid clicking untrusted links referencing internal application URLs.

Patch Information

No vendor advisory or official patch is listed in the enriched data. The vendor did not respond to responsible disclosure. Organizations should monitor ESAFENET communications channels and the VulDB entry for future updates.

Workarounds

Enforce a strict Content Security Policy (CSP) that disallows inline scripts on the CDG application origin.
Configure a reverse proxy to reject requests where curpage is not a positive integer.
Enable HttpOnly and Secure attributes on CDG session cookies to reduce the impact of script-based session theft.

bash

# Example NGINX reverse-proxy rule to reject non-numeric curpage values
location = /todoDetail.jsp {
    if ($arg_curpage !~ "^[0-9]+$") {
        return 400;
    }
    proxy_pass http://cdg_backend;
}