CVE-2024-11949: GFI Archiver RCE Vulnerability

CVE-2024-11949 Overview

CVE-2024-11949 is a deserialization of untrusted data vulnerability [CWE-502] in the GFI Archiver Store Service. The flaw exists in the service that listens on TCP port 8018 by default. Authenticated remote attackers can send crafted serialized objects to the Store Service and execute arbitrary code in the context of SYSTEM. The issue was reported through the Zero Day Initiative as ZDI-CAN-24331 and published as advisory ZDI-24-1672.

Critical Impact
Authenticated attackers can achieve remote code execution as SYSTEM on affected GFI Archiver installations, resulting in full compromise of the archiving server and access to stored email archives.

Affected Products

GFI Archiver (all versions prior to the vendor patch addressing ZDI-24-1672)
GFI Archiver Store Service listening on TCP port 8018
Windows deployments running the affected Store Service under the SYSTEM account

Discovery Timeline

2024-12-12 - CVE-2024-11949 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-11949

Vulnerability Analysis

The vulnerability resides in the GFI Archiver Store Service, a Windows service used to ingest and store archived email data. The service exposes an endpoint on TCP port 8018 that accepts serialized objects from clients. The service deserializes attacker-supplied data without validating type information or restricting allowed classes.

An authenticated attacker with network access to port 8018 can submit a crafted object graph. During deserialization, gadget chains within loaded assemblies trigger arbitrary method invocations. Because the Store Service runs as LocalSystem on Windows, successful exploitation grants full control of the host, including access to archived mailboxes and any credentials stored on the machine.

Root Cause

The root cause is classified as [CWE-502] Deserialization of Untrusted Data. The Store Service invokes a deserializer on data received over the network without applying an allowlist of expected types, signature verification, or a SerializationBinder that constrains deserialization to safe classes. This design permits arbitrary type instantiation and constructor execution during the deserialization step.

Attack Vector

Exploitation requires network reachability to TCP port 8018 and valid authentication to the Store Service. An attacker holding low-privilege credentials establishes a session with the service and transmits a serialized payload containing a gadget chain. The deserializer processes the payload, invokes chained methods, and executes attacker-controlled code under the SYSTEM context. The attack requires no user interaction on the target host.

Refer to the Zero Day Initiative Advisory ZDI-24-1672 for additional technical context.

Detection Methods for CVE-2024-11949

Indicators of Compromise

Unexpected child processes spawned by the GFI Archiver Store Service executable, particularly cmd.exe, powershell.exe, or script interpreters running as SYSTEM.
Inbound TCP connections to port 8018 from hosts that are not authorized archiving clients or management workstations.
New scheduled tasks, services, or local accounts created shortly after Store Service activity on the archiving host.
Outbound network connections initiated by the Store Service process to external addresses.

Detection Strategies

Monitor process creation events where the parent process is the GFI Archiver Store Service and correlate with any command-line interpreter activity.
Alert on deserialization-related exceptions or unusual assembly load events in the Store Service application logs.
Baseline expected clients connecting to TCP 8018 and flag connections from unknown source addresses.

Monitoring Recommendations

Enable Windows process command-line auditing and forward events to a centralized SIEM for correlation across archiving servers.
Capture network flow data at the segment hosting GFI Archiver and inspect connections to port 8018 for anomalous sources or payload sizes.
Track authentication events targeting the Store Service to identify credential abuse preceding exploitation attempts.

How to Mitigate CVE-2024-11949

Immediate Actions Required

Apply the GFI-supplied security update for GFI Archiver addressing ZDI-24-1672 as soon as it is available.
Restrict network access to TCP port 8018 using host-based and network firewalls, permitting only authorized archiving components.
Rotate credentials used by service accounts and administrators with access to the Store Service.
Audit the archiving server for signs of prior exploitation, including unexpected SYSTEM-level processes and new persistence mechanisms.

Patch Information

GFI has been notified through the Zero Day Initiative disclosure process. Administrators should consult the Zero Day Initiative Advisory ZDI-24-1672 and the GFI Archiver product portal for the fixed version and update instructions. Prioritize patching internet-exposed or multi-tenant archiving deployments first.

Workarounds

Place the GFI Archiver server behind a firewall that limits TCP 8018 to a strict allowlist of source addresses until the patch is deployed.
Disable the Store Service temporarily on hosts that do not require active archive ingestion, accepting the operational impact.
Isolate the archiving server in a dedicated network segment with no direct exposure to end-user or internet networks.

bash

# Windows firewall example: restrict TCP 8018 to a specific management subnet
netsh advfirewall firewall add rule name="GFI Archiver Store 8018 Allow" \
    dir=in action=allow protocol=TCP localport=8018 \
    remoteip=10.10.20.0/24

netsh advfirewall firewall add rule name="GFI Archiver Store 8018 Block" \
    dir=in action=block protocol=TCP localport=8018