Path Traversal in GFI Exinda AI

Executive Summary

GFI Exinda AI before version 7.6.5 has a path traversal vulnerability in the diagnostic file deletion handler. The unlink_or_email_file() function processes parameters starting with v_file_row_ and appends their values to a base directory path without sanitizing for directory traversal sequences. This allows an authenticated attacker with Admin privileges to delete arbitrary files on the system with root-level permissions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your GFI Exinda AI version is below 7.6.5. Log in as an admin and inspect network traffic for requests containing parameters like v_file_row_ followed by file paths. Look for unusual file deletion activity in system logs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to delete critical system files, potentially causing system crashes, data loss, or denial of service. Since the attacker operates with root privileges, they could disrupt services, remove logs, or delete configurations, leading to significant operational and security impacts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA by enabling unauthorized file deletion, which may result in loss of personal or sensitive data. Such incidents could violate integrity and availability requirements, triggering regulatory penalties or audits.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update GFI Exinda AI to version 7.6.5 or later. If updating is not possible, restrict Admin access to trusted users only and monitor file deletion operations closely. Consider disabling diagnostic file deletion features temporarily.

Useful 0 Not Useful 0