Exploit Released for GoAnywhere File Transfer Zero-Day Flaw

A zero-day vulnerability affecting on-premise instances of Fortra’s GoAnywhere MFT-managed file transfer solution was actively exploited, according to a warning posted on Mastodon by security researcher Brian Krebs.

GoAnywhere is a safe web file transfer application that allows businesses to securely share encrypted data with partners while maintaining thorough audit logs of file access.

The issue is a remote code injection flaw that needs administrator console access to be exploited effectively.

“A Zero-Day Remote Code Injection exploit was identified in GoAnywhere MFT,” according to the GoAnywhere security advisory.

“The attack vector of this exploit requires access to the administrative console of the application, which in most cases is accessible only from within a private company network, through VPN, or by allow-listed IP addresses (when running in cloud environments, such as Azure or AWS).”

To find out how many GoAnywhere instances are publicly accessible internet, security expert Kevin Beaumont used Shodan and discovered 1,008 servers, mostly in the US.

According to the Rapid7, GoAnywhere MFT customers should verify all administrative accounts and keep an eye out for usernames that aren’t familiar, particularly those that were created by the system. 

“The Fortra advisory Krebs quoted advises GoAnywhere MFT customers to review all administrative users and monitor for unrecognized usernames, especially those created by the system,” Rapid7 said.

“The logical deduction is that Fortra is likely seeing follow-on attacker behavior that includes the creation of new administrative or other users to take over or maintain persistence on vulnerable target systems.”

Security researcher Florian Hauser of IT security consultancy company Code White disclosed technical information and proof-of-concept exploit code on Monday that allows vulnerable GoAnywhere MFT servers to execute unauthenticated remote code.

“I could provide a working PoC (compare hash and time of my tweet) to my teammates within hours on the same day to protect our clients first,” according to Hauser.

“The attack vector of this exploit requires access to the administrative console of the application, which in most cases is accessible only from within a private company network, through VPN, or by allow-listed IP addresses (when running in cloud environments, such as Azure or AWS”, explain Fortra.

A Shodan scan, however, reveals that nearly 1,000 GoAnywhere instances are open on the Internet, with about over 140 on ports 8000 and 8001 (the ones used by the vulnerable admin console).

The firm has not yet made this remote pre-authentication RCE security weakness publicly acknowledged. Hence, you must first sign up for a free account to read the alert, and by not releasing security upgrades to fix the vulnerability, all exposed installations remain subject to assaults.

“If this stacktrace is in the logs, it is very likely this system has been the target of attack,” Fortra says.

Although, a specific stacktrace that appears in the logs of compromised systems is one of the compromise indications listed in the private advisory.

Mitigation

The company offers mitigation guidance, such as putting in place access controls to restrict access to the GoAnywhere MFT administrator interface to authorized users or turning off the licensing service.

Administrators must remove or comment out the License Response Servlet’s servlet-mapping setting from the web.xml file in order to stop the licensing server. 

The updated configuration can only be used after a restart.

“Due to the fact that data in your environment could have been accessed or exported, you should determine whether you have stored credentials for other systems in the environment and make sure those credentials have been revoked,” Fortra made this update in a Saturday update.

“This includes passwords and keys used to access any external systems with which GoAnywhere is integrated.

“Ensure that all credentials have been revoked from those external systems and review relevant access logs related to those systems. This also includes passwords and keys used to encrypt files within the system.”

Network Security Checklist – Download Free E-Book