Path Traversal in GFI Exinda AI

Executive Summary

GFI Exinda AI before version 7.6.5 has a path traversal vulnerability in the system maintenance configuration download handler. The function wcf_handle_download() accepts parameters starting with v_del_ and directly appends their values to the base configuration directory path without checking for directory traversal sequences. An authenticated attacker with Admin privileges can exploit this to read arbitrary files on the system as root.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your GFI Exinda AI version is prior to 7.6.5. Exploitable parameters include those prefixed with v_del_ in the configuration download handler. No specific commands are provided in the context, but monitoring file access logs for unusual paths or unauthorized file reads may help.

Useful 0 Not Useful 0

Impact Analysis

An attacker with Admin access could exploit this to read sensitive system files, including configuration files, logs, or other data stored on the system. This could lead to information disclosure, potential privilege escalation, or further attacks if critical files are accessed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for data protection such as GDPR or HIPAA. Exposure of personal or health information due to file access could result in regulatory penalties, legal consequences, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade GFI Exinda AI to version 7.6.5 or later to patch the vulnerability. Ensure only trusted administrators have access to the system. Review and restrict file access permissions to minimize potential impact.

Useful 0 Not Useful 0