GFI MailEssentials AI Arbitrary File Enumeration Vulnerability in ListServer Web Method

GFI MailEssentials AI versions prior to 22.4 have an arbitrary file existence enumeration vulnerability in the ListServer.IsDBExist() web method, located at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsDBExist. This vulnerability allows authenticated users to send unrestricted filesystem paths via the JSON key 'path'. The server URL-decodes this input and passes it to the File.Exists() function, enabling attackers to check for the existence of arbitrary files on the server.

Impact

Exploitation of this vulnerability allows for arbitrary file existence enumeration, where an authenticated user can determine the presence of specific files on the server's filesystem.

Remediation

Users can upgrade to GFI MailEssentials AI version 22.4 or later to address this vulnerability.