CVE-2024-11947

Executive Summary

CVE-2024-11947 is a critical remote code execution (RCE) vulnerability in GFI Archiver’s Core Service, which listens on TCP port 8017 by default. The flaw stems from deserialization of untrusted data (CWE-502), allowing an authenticated attacker to execute arbitrary code with SYSTEM privileges. With a CVSS score of 8.8, this vulnerability poses a severe risk to enterprise environments using GFI Archiver for email archiving and compliance. No public proof-of-concept (PoC) or patch details are currently available, but the vulnerability was reported via ZDI (ZDI-CAN-24029). Immediate mitigation measures are recommended.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs valid credentials.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality/Integrity/Availability Impact: High (C:H/I:H/A:H) – full system compromise.

Threat Level: Critical. The combination of remote exploitation, low complexity, and SYSTEM-level code execution makes this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability resides in the GFI Archiver Core Service, which deserializes data received over TCP port 8017 without proper validation. Deserialization of untrusted data (CWE-502) occurs when the application reconstructs objects from serialized input without sanitization. An authenticated attacker can craft a malicious serialized payload that, when deserialized by the service, triggers arbitrary code execution in the context of the SYSTEM account.

Key Technical Details:

• Service: GFI Archiver Core Service (default port 8017)
• Flaw: Lack of validation on deserialized data, allowing injection of malicious objects.
• Impact: Full system compromise, including data exfiltration, lateral movement, and persistence.
• Authentication: Required, but low-privileged credentials are sufficient.

Vulnerable vs. Patched Code

No official patch or version information is available. The vulnerability was reported to ZDI, and GFI has not released a security update as of this report. The following is a hypothetical comparison based on typical deserialization vulnerabilities:

Vulnerable Code (C# example):

// Vulnerable: Direct deserialization without validation
BinaryFormatter formatter = new BinaryFormatter();
using (MemoryStream stream = new MemoryStream(data))
{
    object obj = formatter.Deserialize(stream);
    // Process object...
}

Patched Code (Hypothetical):

// Patched: Use safe deserialization with type validation
var settings = new JsonSerializerSettings
{
    TypeNameHandling = TypeNameHandling.None, // Disable polymorphic deserialization
    SerializationBinder = new CustomBinder() // Restrict allowed types
};
var obj = JsonConvert.DeserializeObject<SafeType>(data, settings);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid credentials for GFI Archiver (low-privilege user).
• Network access to the Core Service on TCP 8017.

Exploitation Steps:

1. Reconnaissance: Identify GFI Archiver instances using Shodan dorks (port:8017 GFI Archiver).
2. Authentication: Obtain valid credentials via phishing, password spraying, or other means.
3. Craft Payload: Use a tool like ysoserial.net to generate a malicious serialized object targeting the .NET deserialization vulnerability.

   # Example using ysoserial.net
   ysoserial.exe -f BinaryFormatter -g TextFormattingRunProperties -c "calc.exe"
   

4. Send Payload: Connect to the Core Service on port 8017 and send the crafted payload.

   import socket
   payload = b"<serialized_payload>"
   sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   sock.connect(("target_ip", 8017))
   sock.send(payload)
   sock.close()
   

5. Execute: The service deserializes the payload, executing arbitrary code as SYSTEM.

Blue Team (Detection & Defense)

Detection:

• Monitor network traffic to/from port 8017 for anomalous serialized data patterns.
• Enable logging on GFI Archiver Core Service to capture deserialization errors.
• Use endpoint detection and response (EDR) to monitor for suspicious process creation (e.g., calc.exe, powershell.exe).

Defense:

• Restrict network access to port 8017 using firewall rules (allow only trusted IPs).
• Implement application-level authentication and authorization controls.
• Apply the principle of least privilege to GFI Archiver accounts.
• Monitor for known deserialization attack tools (e.g., ysoserial.net).

Indicators of Compromise (IOCs)

• Network IOCs:
  • Unusual traffic to TCP port 8017 containing serialized .NET objects (e.g., \x00\x01\x00\x00\x00\xff\xff\xff\xff).
  • Connections from unexpected IP addresses to the Core Service.
• File IOCs:
  • Presence of ysoserial.net or similar tools on the network.
  • Unexpected executables or scripts in temporary directories (e.g., %TEMP%).
• Process IOCs:
  • Spawning of cmd.exe, powershell.exe, or wscript.exe from the GFI Archiver process.
  • Unusual child processes of GFIArchiverService.exe.

Detection Engineering

YARA Rule

rule CVE_2024_11947_Deserialization {
    meta:
        description = "Detects serialized .NET payloads targeting GFI Archiver Core Service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11947"
    strings:
        $binary_formatter = { 00 01 00 00 00 ff ff ff ff }
        $text_formatting = "TextFormattingRunProperties"
        $ps_command = "powershell" nocase
    condition:
        $binary_formatter and ($text_formatting or $ps_command)
}

Sigma Rule

title: GFI Archiver Core Service Deserialization Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects network traffic to port 8017 with serialized .NET data
author: Valters IT
date: 2025-04-10
logsource:
    category: network_connection
    product: windows
detection:
    selection:
        DestinationPort: 8017
        Payload|contains: 
            - '\x00\x01\x00\x00\x00\xff\xff\xff\xff'
            - 'TextFormattingRunProperties'
    condition: selection
falsepositives:
    - Legitimate GFI Archiver traffic (rare)
level: high

Suricata Rule

alert tcp any any -> any 8017 (msg:"CVE-2024-11947 GFI Archiver Deserialization Attempt"; flow:to_server,established; content:"|00 01 00 00 00 ff ff ff ff|"; fast_pattern; content:"TextFormattingRunProperties"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: Disconnect GFI Archiver servers from the network if possible.
2. Restrict Access: Use firewall rules to limit access to port 8017 to only trusted IP addresses.
3. Monitor Logs: Enable detailed logging on the Core Service and review for suspicious activity.

Long-Term Fixes:

• Apply the official patch from GFI once released (monitor GFI security advisories).
• Upgrade to a patched version of GFI Archiver.
• Implement network segmentation to reduce exposure of critical services.

Compensating Controls:

• Deploy an intrusion prevention system (IPS) with the provided Suricata rule.
• Use application whitelisting to prevent unauthorized code execution.
• Enforce multi-factor authentication (MFA) for all GFI Archiver accounts.

Valters IT
DevSecOps & Cyber Threat Intelligence