Scans for ESAFENET CDG 3 Document Management System Weak Logins, (Sun, Jul 26th)

Background

ESAFENET’s CDG showed up in our data before. The company focuses on secure document management and data leakage prevention solutions. The "CDG" stands for "Content Data Guard", and the product appears to be mostly targeting the Chinese market [1]. Sadly, like so many security products, it suffers from basic security vulnerabilities like SQL Injection, XSS, and default passwords. We have seen scanning for ESAFENET CDG before, in particular after the cross-site scripting vulnerability was made public.

Current Scanning Activity

The scans we are seeing right now are going after the well-known default passwords that ESAFENET CDG ships with. Exploit scripts listing these passwords are, for example, included in a Nuclei template published in 2023 [2]. A typical POST request seen in the wild is:

POST /CDGServer3/SystemConfig
Host: [redacted]
User-Agent: Mozilla/5.0 (Ubuntu; Linux i686; rv:124.0) Gecko/20100101 Firefox/124.0
Content-Length: 73
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close

command=Login&help=null&verifyCodeDigit=dfd&name=secadmin&pass=Est@Spc820

Default Password Weakness

This is a typical case of a password that will likely pass many standard security checks (10 characters, upper/lower case, special characters, and numbers), but it is still terribly insecure as it is a well-known default password.

[1] https://esafenet.com
[2] https://github.com/projectdiscovery/nuclei-templates/issues/7094

-- Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu