GFI Archiver Remote Code Execution Vulnerability via Deserialization of Untrusted Data

A remote code execution vulnerability has been identified in GFI Archiver due to improper validation of user-supplied data, allowing for the deserialization of untrusted data. This issue arises in the MArc.Core.Remoting.exe process, which listens on port 8017. Although authentication is required to exploit this vulnerability, it can be bypassed, enabling attackers to execute arbitrary code on the affected system with SYSTEM privileges.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected system, with the executed code running in the context of the SYSTEM user.

Remediation

Users can upgrade to GFI Archiver version 15.11 to address this vulnerability.