CVE-2023-0669

Description

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

References

https://research.checkpoint.com/2024/sharp-dragon-expands-towards-africa-and-the-caribbean/

https://www.theregister.com/2024/05/13/cisa_ascension_ransomware/

https://services.google.com/fh/files/misc/m-trends-2024.pdf

https://www.offsec.com/offsec/cyber-range-xz/

https://www.zdnet.com/article/ransomware-leak-site-reports-rose-by-49-in-2023-but-there-is-good-news/?&web_view=true

https://www.zdnet.com/article/ransomware-leak-site-reports-rose-by-49-in-2023-but-there-is-good-news/#ftag=RSSbaffb68

https://www.bleepingcomputer.com/news/security/exploit-released-for-fortra-goanywhere-mft-auth-bypass-bug/

https://securityaffairs.com/157993/hacking/fortra-goanywhere-mft-critical-flaw.html

https://www.bleepingcomputer.com/news/security/fortra-warns-of-new-critical-goanywhere-mft-auth-bypass-patch-now/

https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/

https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1

https://infosec.exchange/@briankrebs/109795710941843934

https://github.com/rapid7/metasploit-framework/pull/17607

https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft

http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3