Scans for ESAFENET CDG 3 Document Management System Weak Logins
ESAFENET's CDG showed up in our data before. The company focused on secure document management and data leakage prevention solutions. The "CDG" stands for "Content Data Guard", and the product appears to be mostly targeting the Chinese market [1]. Sadly, like so many security products, it suffers from basic security vulnerabilities like SQL Injection, XSS, and default passwords. We have seen scanning for ESAFENET CDG before, in particular after the cross-site scripting vulnerability was made public.
The scans we are seeing right now are going after the well-known default passwords that ESAFENET CDG ships with. Exploit scripts listing these passwords are, for example, included in a nulei template published in 2023 [2].
POST /CDGServer3/SystemConfig
Host: [redacted]
User-Agent: Mozilla/5.0 (Ubuntu; Linux i686; rv:124.0) Gecko/20100101 Firefox/124.0
Content-Length: 73
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
Connection: close
command=Login&help=null&verifyCodeDigit=dfd&name=secadmin&pass=Est@Spc820
This is a typical case of a password that will likely pass many standard security checks (10 characters, upper/lower case, special characters, and numbers), but it is still terribly insecure as it is a well-known default password.
[1] https://esafenet.com
[2] https://github.com/projectdiscovery/nuclei-templates/issues/7094
--
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|
Comments