GFI MailEssentials AI Directory Enumeration Vulnerability in ListServer Web Method

A directory existence enumeration vulnerability has been identified in GFI MailEssentials AI versions prior to 22.4. The issue resides in the ListServer.IsPathExist() web method, accessible at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsPathExist. This vulnerability allows authenticated users to send arbitrary filesystem paths via the JSON key 'path'. The supplied paths are URL-decoded and evaluated using Directory.Exists(), enabling attackers to determine the existence of specific directories on the server.

Impact

Exploitation of this vulnerability allows for arbitrary directory existence enumeration on the server, which could be used as a precursor to further attacks, such as path traversal or file inclusion vulnerabilities.

Remediation

Users are advised to upgrade to GFI MailEssentials AI version 22.4 or later.