CVE-2025-0795: Esafenet CDG V5 XSS Vulnerability

CVE-2025-0795 Overview

CVE-2025-0795 is a reflected cross-site scripting (XSS) vulnerability in ESAFENET CDG V5, a data governance and document security product. The flaw resides in the /todolistjump.jsp endpoint, where the flowId request parameter is rendered without proper output encoding or input sanitization. An authenticated remote attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser session. The issue is tracked under CWE-79 and has been publicly disclosed. According to the CVE record, the vendor was notified prior to disclosure but did not respond.

Critical Impact
Attackers can execute arbitrary JavaScript in an authenticated user's browser through a crafted flowId parameter, enabling session theft, credential harvesting, and unauthorized actions within the CDG application.

Affected Products

ESAFENET CDG V5
CPE: cpe:2.3:a:esafenet:cdg:5:*:*:*:*:*:*:*
Component: esafenet:cdg

Discovery Timeline

2025-01-29 - CVE-2025-0795 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0795

Vulnerability Analysis

The vulnerability affects the todolistjump.jsp server page in ESAFENET CDG V5. The JSP accepts a flowId query parameter and reflects the supplied value into the rendered HTML response without contextual output encoding. Because the parameter is emitted directly into the page, an attacker can inject HTML and JavaScript payloads that execute in the browsers of authenticated users who follow a crafted link.

The attack requires a low level of privilege on the target application but no user interaction beyond opening the malicious link. Successful exploitation compromises the integrity of the affected user's session and any in-browser data the CDG application exposes. Confidentiality and availability of the server itself are not directly affected, but stolen session tokens can enable follow-on actions against sensitive documents managed by CDG.

With an EPSS probability of 0.43% (36.15th percentile) and no confirmed exploitation activity, opportunistic mass exploitation appears unlikely. However, ESAFENET CDG deployments typically handle regulated intellectual property, making targeted XSS abuse a realistic threat.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The todolistjump.jsp handler concatenates the untrusted flowId parameter into the HTML response without HTML-entity encoding or allow-list validation. No Content Security Policy (CSP) is enforced to mitigate script execution.

Attack Vector

An attacker with a valid low-privilege account crafts a URL of the form /todolistjump.jsp?flowId=<payload> containing a JavaScript payload. The attacker delivers the link to a target user via phishing, chat, or an internal message. When the victim opens the link while authenticated to CDG, the injected script runs in the origin of the CDG server. The script can read cookies not marked HttpOnly, exfiltrate DOM data, submit forms as the victim, or pivot to CSRF-style actions against other CDG endpoints.

A proof-of-concept describing the request format is documented in the public GitHub report on todolistjump.jsp. See also VulDB entry 293919 for additional metadata.

Detection Methods for CVE-2025-0795

Indicators of Compromise

HTTP requests to /todolistjump.jsp where the flowId parameter contains HTML control characters such as <, >, ", ', or URL-encoded equivalents (%3C, %3E).
flowId values containing script-related keywords such as script, onerror, onload, javascript:, alert(, document.cookie, or String.fromCharCode.
Outbound browser traffic from CDG users to unexpected external hosts immediately after loading todolistjump.jsp.
Anomalous session activity, such as sudden document downloads or privilege changes, following a click on an emailed CDG link.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the flowId parameter on todolistjump.jsp and block requests containing HTML or script metacharacters.
Enable verbose access logging on the CDG web tier and alert on abnormal flowId payload length or non-numeric content, since flowId is expected to be a workflow identifier.
Correlate CDG access logs with endpoint telemetry to identify users whose browsers loaded a suspicious flowId URL and then initiated unusual outbound connections.

Monitoring Recommendations

Forward CDG web server and reverse proxy logs to a centralized analytics platform and build detections around the todolistjump.jsp endpoint.
Monitor email and messaging gateways for links pointing to internal CDG hosts with encoded flowId query strings.
Track authentication and document-access events for accounts that recently visited a crafted todolistjump.jsp URL to identify session hijack indicators.

How to Mitigate CVE-2025-0795

Immediate Actions Required

Restrict network exposure of the CDG web interface to trusted management networks or VPN users until a vendor fix is available.
Deploy WAF or reverse-proxy rules that reject requests to /todolistjump.jsp when flowId contains anything other than the expected numeric or alphanumeric identifier format.
Notify CDG users to avoid clicking unsolicited links that reference internal CDG URLs, and require re-authentication after suspicious activity.
Rotate session cookies and force re-login for any account suspected of visiting a malicious flowId link.

Patch Information

At the time of publication, no vendor patch or security advisory has been issued by ESAFENET. According to the CVE record, the vendor did not respond to the disclosure. Operators should monitor ESAFENET support channels for future updates and apply any released fix immediately. Reference material is available via the VulDB submission for CVE-2025-0795.

Workarounds

Configure the reverse proxy or WAF to HTML-entity encode or reject non-conforming flowId values before they reach the JSP handler.
Set the HttpOnly and Secure flags on CDG session cookies to reduce the impact of script-based cookie theft.
Enforce a strict Content Security Policy at the reverse proxy that disallows inline scripts and unapproved script sources for CDG responses.
Limit CDG account privileges to the minimum required for each user's role to reduce the blast radius of a hijacked session.

bash

# Example NGINX rule to block suspicious flowId values on todolistjump.jsp
location = /todolistjump.jsp {
    if ($arg_flowId ~* "[<>\"'();]|script|onerror|onload|javascript:") {
        return 403;
    }
    proxy_pass http://cdg_backend;
}