CVE-2024-11948: GFI Archiver Telerik Web UI RCE Vulnerability

CVE-2024-11948 Overview

CVE-2024-11948 is a critical remote code execution vulnerability affecting GFI Archiver. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver without requiring authentication. The specific flaw exists within the product installer, which bundles a vulnerable version of Telerik Web UI. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE.

Critical Impact

Unauthenticated remote attackers can achieve arbitrary code execution on GFI Archiver installations by exploiting the vulnerable Telerik Web UI component, potentially leading to complete system compromise.

Affected Products

• GFI Archiver (all versions prior to patched release)
• Systems with vulnerable Telerik Web UI component bundled via GFI Archiver installer

Discovery Timeline

• 2024-12-12 - CVE-2024-11948 published to NVD (originally tracked as ZDI-CAN-24041)
• 2024-12-13 - Last updated in NVD database

Technical Details for CVE-2024-11948

Vulnerability Analysis

This vulnerability stems from the use of a known-vulnerable version of Telerik Web UI that is bundled with the GFI Archiver product installer. Telerik Web UI has a history of serious security vulnerabilities, and when legacy versions are incorporated into third-party software distributions, they inherit those security weaknesses. The affected component allows unauthenticated remote attackers to execute arbitrary code on the target system.

The vulnerability is network-accessible, requires no user interaction, and does not require any privileges to exploit, making it particularly dangerous for internet-facing deployments. Successful exploitation results in code execution within the context of NETWORK SERVICE, which provides attackers with a foothold for further lateral movement or privilege escalation within the compromised environment.

Root Cause

The root cause of this vulnerability is the inclusion of an outdated, vulnerable version of Telerik Web UI within the GFI Archiver product installer. Rather than a flaw in GFI's own code, this represents a supply chain security issue where a third-party component introduces significant security risks. Telerik Web UI has been associated with multiple critical vulnerabilities including deserialization flaws and cryptographic weaknesses that enable remote code execution.

Attack Vector

The attack vector is network-based, allowing remote exploitation without authentication. An attacker can target the Telerik Web UI component exposed through the GFI Archiver web interface. The vulnerability can be exploited by sending specially crafted requests to the vulnerable Telerik endpoints, which may involve exploitation of known Telerik vulnerabilities such as insecure deserialization or cryptographic key disclosure.

For detailed technical information regarding the exploitation mechanism, refer to the Zero Day Initiative Advisory ZDI-24-1671.

Detection Methods for CVE-2024-11948

Indicators of Compromise

• Unexpected processes spawning under the NETWORK SERVICE account on GFI Archiver servers
• Anomalous HTTP requests targeting Telerik-specific endpoints such as Telerik.Web.UI.WebResource.axd or Telerik.Web.UI.DialogHandler.aspx
• Suspicious outbound network connections from GFI Archiver application processes
• Evidence of web shell deployment or unauthorized file creation in web-accessible directories

Detection Strategies

• Implement network intrusion detection rules to identify known Telerik exploitation patterns in HTTP traffic
• Monitor web server logs for requests containing suspicious Telerik Web UI handler parameters
• Deploy endpoint detection solutions to identify unauthorized code execution under service accounts
• Audit installed Telerik Web UI versions across the environment for known vulnerable releases

Monitoring Recommendations

• Enable verbose logging on GFI Archiver web components and forward logs to a SIEM for correlation
• Monitor for process creation events originating from IIS worker processes or application pools associated with GFI Archiver
• Implement file integrity monitoring on GFI Archiver installation directories to detect unauthorized modifications
• Track authentication and authorization events for anomalous access patterns

How to Mitigate CVE-2024-11948

Immediate Actions Required

• Identify all GFI Archiver installations within the environment and assess exposure
• Restrict network access to GFI Archiver web interfaces to trusted networks only pending patch deployment
• Apply available security updates from GFI as soon as they are released
• Consider temporarily disabling or blocking access to Telerik-related endpoints if operationally feasible

Patch Information

Organizations should consult GFI for the latest security updates addressing this vulnerability. Review the Zero Day Initiative Advisory ZDI-24-1671 for additional details regarding the vulnerability disclosure and remediation guidance. Ensure that any patched version includes an updated Telerik Web UI component that is not susceptible to known exploitation techniques.

Workarounds

• Implement network segmentation to isolate GFI Archiver servers from untrusted networks
• Deploy a web application firewall (WAF) with rules to block known Telerik exploitation payloads
• Restrict access to the GFI Archiver web interface using IP allowlisting or VPN requirements
• Monitor the system for signs of compromise while awaiting official patches

# Example: Restrict access to GFI Archiver via Windows Firewall
# Block external access to the GFI Archiver web port (adjust port as needed)
netsh advfirewall firewall add rule name="Block External GFI Archiver Access" dir=in action=block protocol=tcp localport=80,443 remoteip=any
netsh advfirewall firewall add rule name="Allow Internal GFI Archiver Access" dir=in action=allow protocol=tcp localport=80,443 remoteip=localsubnet