Stored XSS in GFI Archiver SMTP Configuration

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in GFI Archiver before version 15.13. It allows authenticated attackers to inject malicious scripts via the SMTP server address parameter in the General Settings SMTP configuration page. The injected payload is stored without proper encoding and later executed in the browsers of users who view the General Settings page.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your GFI Archiver version is prior to 15.13. Inspect the General Settings SMTP configuration page (GeneralSettingsWizard.aspx) for unauthorized script injections in the SMTP server address parameter. Review server logs for suspicious activity related to GeneralSettingsWizard.SaveAllConfigSettings().

No specific commands are provided in the context, but manual inspection of the application and logs is recommended.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or redirect users to malicious websites. Users with access to the General Settings page may unknowingly execute the injected scripts, leading to potential data theft or unauthorized actions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. Organizations may face compliance penalties if user data is compromised due to this flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade GFI Archiver to version 15.13 or later to patch the vulnerability. If immediate upgrade is not possible, restrict access to the General Settings page to trusted administrators only and monitor for unusual activity.

Useful 0 Not Useful 0