Stored XSS in GFI Archiver Classification Rules Configuration

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in GFI Archiver versions before 15.13. It allows authenticated attackers to inject malicious scripts through the rule name and email criteria parameters in the Classification Rules configuration page. The injected payload is stored without proper encoding and later executed in the browsers of users viewing the Classification Rules page.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect GFI Archiver versions before 15.13 for stored XSS in Classification Rules. Check the CategorizationPolicyWizard.aspx page for unauthorized script injection in rule names or email criteria. Review server logs for suspicious POST requests to /Archiver/CategorizationPolicyWizard.aspx with payloads in parameters.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or redirect users to malicious websites. Users with access to the Classification Rules page are at risk of having their browsers compromised by the stored malicious scripts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR's data protection requirements or HIPAA's privacy and security rules. Organizations may face compliance penalties if user data is compromised due to this flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade GFI Archiver to version 15.13 or later to patch the vulnerability. If immediate upgrade is not possible, restrict access to the CategorizationPolicyWizard.aspx page to trusted administrators only and monitor for unusual activity.

Useful 0 Not Useful 0