Exploit Released for GoAnywhere File Transfer Zero-Day Flaw

A zero-day vulnerability affecting on-premise instances of Fortra’s GoAnywhere MFT-managed file transfer solution was actively exploited, according to a warning posted on Mastodon by security researcher Brian Krebs.

GoAnywhere is a safe web file transfer application that allows businesses to securely share encrypted data with partners while maintaining thorough audit logs of file access.

The issue is a remote code injection flaw that needs administrator console access to be exploited effectively.

“A Zero-Day Remote Code Injection exploit was identified in GoAnywhere MFT,” according to the GoAnywhere security advisory.

“The attack vector of this exploit requires access to the administrative console of the application, which in most cases is accessible only from within a private company network, through VPN, or by allow-listed IP addresses (when running in cloud environments, such as Azure or AWS).”

To find out how many GoAnywhere instances are publicly accessible internet, security expert Kevin Beaumont used Shodan and discovered 1,008 servers, mostly in the US.

Shodan scan results for exposed GoAnywhere MFT

According to the Rapid7, GoAnywhere MFT customers should verify all administrative accounts and keep an eye out for usernames that aren’t familiar, particularly those that were created by the system. 

“The Fortra advisory Krebs quoted advises GoAnywhere MFT customers to review all administrative users and monitor for unrecognized usernames, especially those created by the system,” Rapid7 said.

“The logical deduction is that Fortra is likely seeing follow-on attacker behavior that includes the creation of new administrative or other users to take over or maintain persistence on vulnerable target systems.”

Security researcher Florian Hauser of IT security consultancy company Code White disclosed technical information and proof-of-concept exploit code on Monday that allows vulnerable GoAnywhere MFT servers to execute unauthenticated remote code.

“I could provide a working PoC (compare hash and time of my tweet) to my teammates within hours on the same day to protect our clients first,” according to Hauser.

“The attack vector of this exploit requires access to the administrative console of the application, which in most cases is accessible only from within a private company network, through VPN, or by allow-listed IP addresses (when running in cloud environments, such as Azure or AWS”, explain Fortra.

A Shodan scan, however, reveals that nearly 1,000 GoAnywhere instances are open on the Internet, with about over 140 on ports 8000 and 8001 (the ones used by the vulnerable admin console).

Map of GoAnywhere MFT servers that are vulnerable

The firm has not yet made this remote pre-authentication RCE security weakness publicly acknowledged. Hence, you must first sign up for a free account to read the alert, and by not releasing security upgrades to fix the vulnerability, all exposed installations remain subject to assaults.

“If this stacktrace is in the logs, it is very likely this system has been the target of attack,” Fortra says.

Although, a specific stacktrace that appears in the logs of compromised systems is one of the compromise indications listed in the private advisory.

Mitigation

The company offers mitigation guidance, such as putting in place access controls to restrict access to the GoAnywhere MFT administrator interface to authorized users or turning off the licensing service.

Administrators must remove or comment out the License Response Servlet’s servlet-mapping setting from the web.xml file in order to stop the licensing server. 

The updated configuration can only be used after a restart.

Code to remove/comment out to disable GoAnywhere MFT’s licensing service

“Due to the fact that data in your environment could have been accessed or exported, you should determine whether you have stored credentials for other systems in the environment and make sure those credentials have been revoked,” Fortra made this update in a Saturday update.

“This includes passwords and keys used to access any external systems with which GoAnywhere is integrated.

“Ensure that all credentials have been revoked from those external systems and review relevant access logs related to those systems. This also includes passwords and keys used to encrypt files within the system.”

Network Security Checklist – Download Free E-Book

Guru baran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting the growing, widespread use and potential…

9 hours ago

C2A Security’s EVSec Risk Management and Automation Platform Gains Automotive Industry Favor as Companies Pursue Regulatory Compliance

In 2023, C2A Security added multiple OEMs and Tier 1s to its portfolio of customers, successful evaluations, and partnerships such…

10 hours ago

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and education. The latest update, Wireshark 4.2.4,…

12 hours ago

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered platform designed to redefine how we…

12 hours ago

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information and grant unauthorized access. It's an…

13 hours ago

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including two zero-day exploits showcased at the…

17 hours ago