Description

GFI Exinda AI before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools_cmd() function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An authenticated attacker with Unprivileged (lowest-level) access can supply the iperf -F flag to read an arbitrary file from the system and transmit its contents to an attacker-controlled server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-04T13:20:08.607Z",
  "pubdate": "2026-09-04T13:20:08.607Z",
  "executiveSummary": "An argument injection vulnerability exists in GFI Exinda AI versions prior to 7.6.5, located within the Tools Iperf Client functionality. This security flaw poses a significant risk by allowing authenticated users with the lowest privilege level (Unprivileged) to execute unauthorized operations on the underlying system. By exploiting this vulnerability, an attacker can bypass intended administrative boundaries and execute arbitrary iperf commands. The primary impact of successful exploitation is the unauthorized retrieval of sensitive system files and the subsequent exfiltration of this data to an attacker-controlled server. Because the vulnerability requires only low-privileged authentication, the barrier to entry for internal adversaries or compromised accounts is minimal, resulting in elevated risks to confidentiality and data integrity.",
  "technicalDetails": "The root cause of this vulnerability lies in the 'web_tools_cmd()' function within GFI Exinda AI before version 7.6.5. This function is designed to construct and execute system-level iperf commands using parameters supplied via the Tools Iperf Client web interface. Specifically, the application processes user-supplied data through the 'server' and 'options' parameters without performing adequate input validation, filtering, or shell sanitization. This allows command-line options and arguments to be passed directly to the binary execution context.\nAn authenticated attacker possessing low-privilege (Unprivileged) credentials can access this diagnostic tool and supply malicious inputs. By manipulating the 'options' parameter, the attacker can introduce additional command-line flags recognized by the underlying iperf executable rather than just standard operational options.\nThe conceptual attack flow is executed as follows: First, the attacker authenticates to the Exinda AI management console using low-privilege credentials. Second, the attacker accesses the web-based Tools Iperf Client interface. Third, the attacker initiates a request where the 'server' parameter points to a receiving host under their control, and the 'options' parameter is populated with the '-F' flag, specifying a target local system file path. Fourth, the 'web_tools_cmd()' function concatenates these parameters without validation and executes the system command. Finally, the local iperf process reads the specified file and transmits its raw content to the attacker's server, resulting in arbitrary file exposure."
}