Stored XSS in GFI Archiver Retention Policy Configuration

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in GFI Archiver versions before 15.13. An authenticated attacker can inject malicious scripts via the policy name parameter in the Retention Policy configuration. The payload is stored without proper encoding and later executed when users view the Retention and Spam Policies page.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect GFI Archiver versions before 15.13. Check the RetentionPolicyWizard.aspx file for unauthorized script injections in policy names. Review server logs for suspicious input via the policy name parameter.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. Users viewing the Retention and Spam Policies page may unknowingly execute the injected scripts, compromising their data or account.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance penalties if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade GFI Archiver to version 15.13 or later. Apply input validation to the policy name parameter. Ensure output encoding is implemented in RetentionPolicyWizard.SaveAllConfigSettings().

Useful 0 Not Useful 0