Accellion FTA SQL Injection + Command Injection Chain
- Product
- Accellion (Kiteworks) File Transfer Appliance (FTA)
- CVE
- CVE-2021-27101CVE-2021-27102CVE-2021-27103CVE-2021-27104
- Disclosed
- 2020-12-23
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Accellion FTA 9_12_370 and earlier (varies per CVE).
- Fixed
- FTA 9_12_416 (product end-of-life April 2021).
Summary
UNC2546 chained SQL injection and command injection bugs in Accellion's legacy File Transfer Appliance to deploy the DEWMODE webshell and steal data, followed by Cl0p-branded extortion. Victims included universities, governments and law firms.
Root cause
CVE-2021-27101 is a SQL injection via a crafted Host header to document_root.html, allowing theft of keys from the database. Combined with SSRF (27103) and OS command injection (27102, 27104), attackers achieved code execution and planted DEWMODE to list and download files.
Impact
Unauthenticated code execution and mass data theft.
Detection
Look for /home/seos/courier/about.html (DEWMODE) and suspicious requests to document_root.html in logs.
Mitigation
Retire FTA (EOL) and migrate to a supported platform.