CVE-2023-0669

Description

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

References

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a

https://blog.talosintelligence.com/common-ransomware-actor-ttps-playbooks/

https://www.bleepingcomputer.com/news/security/exploit-for-critical-fortra-filecatalyst-workflow-sqli-flaw-released/

https://www.cybersecurity-insiders.com/the-public-sectors-troubled-relationship-to-ransomware-in-2023-a-year-in-review/?utm_source=rss&utm_medium=rss&utm_campaign=the-public-sectors-troubled-relationship-to-ransomware-in-2023-a-year-in-review

https://research.checkpoint.com/2024/sharp-dragon-expands-towards-africa-and-the-caribbean/

https://www.theregister.com/2024/05/13/cisa_ascension_ransomware/

https://services.google.com/fh/files/misc/m-trends-2024.pdf

https://www.offsec.com/offsec/cyber-range-xz/

https://www.offsec.com/blog/cyber-range-xz/

https://www.zdnet.com/article/ransomware-leak-site-reports-rose-by-49-in-2023-but-there-is-good-news/?&web_view=true

https://www.zdnet.com/article/ransomware-leak-site-reports-rose-by-49-in-2023-but-there-is-good-news/#ftag=RSSbaffb68

https://www.bleepingcomputer.com/news/security/exploit-released-for-fortra-goanywhere-mft-auth-bypass-bug/

https://securityaffairs.com/157993/hacking/fortra-goanywhere-mft-critical-flaw.html

https://www.bleepingcomputer.com/news/security/fortra-warns-of-new-critical-goanywhere-mft-auth-bypass-patch-now/

https://www.tenable.com/blog/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-vulnerability

https://www.tenable.com/blog/faq-for-moveit-transfer-vulnerabilities-cve-2023-34362-and-cl0p-ransomware-gang

https://www.tenable.com/blog/cve-2023-34362-moveit-transfer-critical-zero-day-vulnerability-exploited-in-the-wild

https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/

https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1

https://infosec.exchange/@briankrebs/109795710941843934

https://github.com/rapid7/metasploit-framework/pull/17607

https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3