CVE-2023-0669highunder attackransomwareCWE-502

CVE-2023-0669: high-severity vulnerability in Fortra Goanywhere MFT

Fortra GoAnywhere MFT License Response Servlet Command Injection

Published · Updated

Follow this CVE+ Monitor GoAnywhere MFT

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 7.2epss 100%
from disclosure to weapon4 days
Published on NVDFeb 6
1st PoC+4d
metasploitFeb 1
CISA KEV+4d
Action required by CISAfederal deadline: 2023-03-03

Apply updates per vendor instructions.

In short

Fortra GoAnywhere MFT has a flaw that lets attackers run commands on the server before logging in, by sending specially crafted data that tricks the software into executing malicious code. This is dangerous because anyone on the network can exploit it without needing a password.

Technical detail

The vulnerability exists in the License Response Servlet where untrusted serialized Java objects are deserialized without proper validation, allowing pre-authentication remote code execution. An unauthenticated attacker can exploit this by sending a malicious serialized object to execute arbitrary commands with the application's privileges. Patched in version 7.1.2.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
Fortra · Goanywhere MFT
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.