CVE-2024-11949

Executive Summary

CVE-2024-11949 is a critical remote code execution (RCE) vulnerability in GFI Archiver’s Store Service, which listens on TCP port 8018 by default. The flaw stems from deserialization of untrusted data (CWE-502), allowing an authenticated attacker to execute arbitrary code with SYSTEM privileges. With a CVSS score of 8.8, this vulnerability poses a severe risk to enterprise environments using GFI Archiver for email archiving and compliance. No public exploit or patch is currently available, but the risk is amplified by the service’s network exposure and the high privileges gained upon exploitation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs valid credentials.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality/Integrity/Availability Impact: High (C:H/I:H/A:H) – full system compromise.

Threat Level: Critical due to the potential for full SYSTEM-level compromise, network exposure, and lack of patch.

Deep Dive & Mechanics

The vulnerability resides in the GFI Archiver Store Service, which handles data serialization for storage and retrieval. The service deserializes user-supplied data without proper validation, allowing an attacker to craft malicious serialized objects. When deserialized, these objects can trigger arbitrary code execution in the context of the SYSTEM account.

Root Cause:

• The Store Service uses a deserialization mechanism (likely .NET BinaryFormatter or similar) that does not validate the incoming data stream.
• An authenticated attacker can send a crafted payload to TCP port 8018, which the service deserializes, leading to RCE.

Attack Flow:

1. Attacker authenticates to GFI Archiver (e.g., via valid credentials).
2. Attacker sends a malicious serialized object to the Store Service on port 8018.
3. The service deserializes the object, executing attacker-controlled code.
4. Code runs as SYSTEM, giving full control over the host.

Impact:

• Full system compromise.
• Data exfiltration, lateral movement, and persistence.
• Potential for ransomware deployment or destruction of archived data.

Vulnerable vs. Patched Code

Since no patch is available, a comparison is not possible. However, the vulnerable code likely uses a deserialization method like BinaryFormatter.Deserialize() without a custom SerializationBinder or SurrogateSelector to restrict types. A patched version would implement type validation, use a safe deserialization library (e.g., Newtonsoft.Json with TypeNameHandling.None), or enforce an allowlist of permitted types.

Example of vulnerable code pattern (C#):

// Vulnerable: No type validation
using (var stream = new MemoryStream(data))
{
    var formatter = new BinaryFormatter();
    var obj = formatter.Deserialize(stream); // RCE possible
}

Example of patched code pattern:

// Patched: Use a safe deserializer with type validation
var settings = new JsonSerializerSettings
{
    TypeNameHandling = TypeNameHandling.None // Disable polymorphic deserialization
};
var obj = JsonConvert.DeserializeObject(data, settings);

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Valid credentials for GFI Archiver.
• Network access to the Store Service (port 8018).
• Knowledge of the serialization format (likely .NET binary).

Exploitation Steps:

1. Reconnaissance: Scan for GFI Archiver instances on port 8018.
2. Authentication: Obtain valid credentials (e.g., via phishing or password spraying).
3. Craft Payload: Use a tool like ysoserial.net to generate a malicious .NET serialized payload targeting BinaryFormatter.

   ysoserial.exe -f BinaryFormatter -g TextFormattingRunProperties -c "calc.exe"
   

4. Send Payload: Use a raw socket or custom script to send the payload to the Store Service.

   import socket
   payload = b"<ysoserial output>"
   s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
   s.connect(("target_ip", 8018))
   s.send(payload)
   s.close()
   

5. Execute: The service deserializes the payload, executing the attacker’s command as SYSTEM.

Lab Setup:

• Install GFI Archiver in a VM.
• Use a separate attacker VM with ysoserial.net and Python.
• Monitor with Wireshark to observe the deserialization traffic.

Blue Team (Defensive)

Detection:

• Monitor for unusual network connections to port 8018 from non-admin workstations.
• Enable logging for the Store Service (if available) to capture deserialization errors.
• Use endpoint detection rules for BinaryFormatter deserialization events.

Hunting:

• Search for processes spawning from StoreService.exe (e.g., cmd.exe, powershell.exe).
• Look for anomalous outbound connections from the GFI Archiver server.

Mitigation:

• Restrict network access to port 8018 to only trusted IPs.
• Implement application-level firewalling or IPS rules to block known deserialization payloads.
• Monitor for authentication anomalies (e.g., multiple failed logins followed by successful exploitation).

Indicators of Compromise (IOCs)

• Network:
  • TCP connections to port 8018 from unexpected sources.
  • Large or irregularly structured data packets sent to the Store Service.
• Host:
  • Unusual child processes of StoreService.exe (e.g., cmd.exe, powershell.exe, rundll32.exe).
  • New scheduled tasks or services created by SYSTEM.
  • Files written to %TEMP% or %SYSTEMROOT% by the Store Service.
• Logs:
  • Windows Event ID 4688 (Process Creation) showing StoreService.exe spawning a shell.
  • .NET deserialization errors in application logs (e.g., System.Runtime.Serialization.SerializationException).

Detection Engineering

YARA Rule

rule CVE_2024_11949_GFI_Archiver_Deserialization {
    meta:
        description = "Detects malicious .NET serialized payloads targeting GFI Archiver Store Service"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11949"
    strings:
        $binary_header = { 00 01 00 00 00 FF FF FF FF 01 00 00 00 00 00 00 00 }
        $text_formatting = "TextFormattingRunProperties" nocase
        $ps_object = "System.Management.Automation.PSObject" nocase
    condition:
        $binary_header at 0 and (any of ($text_formatting, $ps_object))
}

Sigma Rule

title: CVE-2024-11949 GFI Archiver Store Service Deserialization RCE
id: 8a3f2c1d-5e7b-4a9f-8c0d-1e2f3a4b5c6d
status: experimental
description: Detects exploitation attempts against GFI Archiver Store Service via deserialization
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\StoreService.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wscript.exe'
            - '\cscript.exe'
    condition: selection
falsepositives:
    - Legitimate administrative scripts (rare)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 8018 (msg:"CVE-2024-11949 GFI Archiver Store Service Deserialization Attempt"; flow:to_server,established; content:"|00 01 00 00 00 FF FF FF FF 01 00 00 00 00 00 00 00|"; depth:16; content:"TextFormattingRunProperties"; nocase; distance:0; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate GFI Archiver servers from untrusted networks.
2. Restrict access to port 8018 to only authorized IPs via firewall rules.
3. Monitor for exploitation attempts using the provided detection rules.
4. Apply vendor patch as soon as it becomes available.

Long-Term Fixes:

• Upgrade to a patched version of GFI Archiver once released.
• Implement network segmentation to limit exposure of critical services.
• Use application allowlisting to prevent unauthorized executables from running.
• Enable detailed logging for the Store Service and review regularly.

Workarounds:

• If possible, disable the Store Service or replace it with a secure alternative.
• Use a reverse proxy with deep packet inspection to filter deserialization payloads.

Valters IT – Securing digital frontiers with precision and expertise.