Stored XSS in GFI Archiver File History Retention Policy

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in GFI Archiver versions before 15.13. An authenticated attacker can inject malicious JavaScript or HTML code into the policy name parameter of the File History Retention Policy configuration page. The injected payload is stored without proper output encoding and later executed when other users view the File History Retention Policies page.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect the File History Retention Policy configuration page in GFI Archiver versions before 15.13. Check for unusual or unexpected JavaScript/HTML code in policy names. Review server logs for requests to /Archiver/FAARetentionPolicyWizard.aspx with suspicious parameters.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to execute arbitrary scripts in the browsers of users who view the affected page. This could lead to session hijacking, theft of sensitive data, or unauthorized actions performed on behalf of the user.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling stored cross-site scripting attacks. If exploited, it may allow attackers to steal sensitive user data or session cookies, which could lead to unauthorized access to personal or health information. This violates data protection principles under GDPR and HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade GFI Archiver to version 15.13 or later immediately. If upgrading is not possible, restrict access to the File History Retention Policy configuration page to trusted administrators only.

Useful 0 Not Useful 0