CVE-2024-11947: GFI Archiver RCE Vulnerability

CVE-2024-11947 Overview

CVE-2024-11947 is a deserialization of untrusted data vulnerability in the GFI Archiver Core Service. The flaw exists in the service listening on TCP port 8017 by default. Authenticated remote attackers can send crafted serialized data to trigger arbitrary code execution in the context of SYSTEM. The issue is tracked under Zero Day Initiative advisory ZDI-24-1670 and was originally identified as ZDI-CAN-24029. The vulnerability maps to [CWE-502] (Deserialization of Untrusted Data).

Critical Impact
Authenticated attackers can achieve remote code execution as SYSTEM on GFI Archiver installations by sending crafted serialized objects to the Core Service on TCP port 8017.

Affected Products

GFI Archiver (all versions prior to the vendor fix)
GFI Archiver Core Service listening on TCP port 8017
Windows systems running the GFI Archiver server component

Discovery Timeline

2024-12-12 - CVE-2024-11947 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11947

Vulnerability Analysis

The vulnerability resides in the GFI Archiver Core Service, a Windows service that accepts network traffic on TCP port 8017. The service accepts serialized objects from clients and reconstructs them without validating the object types or contents. An authenticated attacker who can reach the port can submit a crafted serialized payload that triggers gadget chains during object reconstruction. Execution occurs in the context of the service account, which is SYSTEM. This grants full control over the host, including access to archived mail data and credentials cached on the server.

Root Cause

The root cause is unsafe deserialization of user-supplied data, classified as [CWE-502]. The Core Service invokes a deserializer on network input without enforcing a type allow-list, binder restrictions, or integrity checks. Any client that can authenticate to the service can therefore control the graph of objects instantiated on the server.

Attack Vector

The attack vector is network-based and requires low-privilege authentication. An attacker with valid credentials connects to the Core Service on TCP port 8017 and transmits a malicious serialized payload. During deserialization, embedded gadget chains execute attacker-controlled logic. No user interaction is required, and the impact spans confidentiality, integrity, and availability.

No verified public proof-of-concept code is available. See the Zero Day Initiative Advisory ZDI-24-1670 for the technical writeup.

Detection Methods for CVE-2024-11947

Indicators of Compromise

Unexpected child processes spawned by the GFI Archiver Core Service executable, especially cmd.exe, powershell.exe, or rundll32.exe.
Outbound network connections initiated by the Archiver service process shortly after inbound traffic on TCP port 8017.
New services, scheduled tasks, or local accounts created on the Archiver host without a change record.

Detection Strategies

Monitor process ancestry for the GFI Archiver Core Service and alert on any non-standard child process execution.
Inspect network telemetry for anomalous or unauthenticated connections targeting TCP port 8017 on Archiver servers.
Hunt for .NET or Java deserialization gadget indicators in memory and on disk within the Archiver installation directory.

Monitoring Recommendations

Enable command-line and module-load logging on Archiver hosts, and forward events to a centralized analytics platform.
Baseline normal client connectivity to port 8017 and alert on new source IPs or authentication anomalies.
Correlate authentication events on the Archiver service with subsequent process and file activity to identify post-exploitation behavior.

How to Mitigate CVE-2024-11947

Immediate Actions Required

Apply the vendor patch referenced in ZDI-24-1670 as soon as it is available from GFI.
Restrict network access to TCP port 8017 to trusted management hosts using host firewalls and network ACLs.
Rotate credentials that were valid on the Archiver server, since authenticated access is the exploitation prerequisite.

Patch Information

GFI has coordinated remediation through the Zero Day Initiative. Administrators should consult the Zero Day Initiative Advisory ZDI-24-1670 and the GFI Archiver release notes for the fixed build. Install the update on every Archiver server and restart the Core Service to complete remediation.

Workarounds

Block inbound traffic to TCP port 8017 from untrusted network segments until the patch is applied.
Require multi-factor authentication and least-privilege access for accounts that can reach the Archiver Core Service.
Isolate the Archiver server on a dedicated management VLAN to reduce exposure to compromised workstations.

bash

# Example: restrict access to the GFI Archiver Core Service port on Windows
netsh advfirewall firewall add rule name="GFI Archiver 8017 Allowlist" ^
  dir=in action=allow protocol=TCP localport=8017 ^
  remoteip=10.0.0.0/24 profile=any

netsh advfirewall firewall add rule name="GFI Archiver 8017 Block" ^
  dir=in action=block protocol=TCP localport=8017 profile=any