GoAnywhere MFT License Servlet Deserialization RCE
- Product
- Fortra GoAnywhere MFT
- CVE
- CVE-2023-0669
- Disclosed
- 2023-02-01
- CVSS
- 7.2
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- GoAnywhere MFT before 7.1.2 with the admin console exposed.
- Fixed
- 7.1.2.
Summary
A pre-authentication deserialization flaw in the GoAnywhere MFT admin console was exploited by Cl0p as a zero-day, compromising about 130 organizations. Fortra initially disclosed it only in a private customer advisory.
Root cause
The License Response servlet deserializes a Java object from an encrypted request parameter. The encryption used a hard-coded key, so attackers could craft encrypted serialized gadget chains that execute code when deserialized.
Impact
Unauthenticated code execution on the MFT server and data theft.
Detection
Search admin console logs for unexpected requests to /goanywhere/lic/accept and errors referencing the license servlet. Nuclei template CVE-2023-0669.
Mitigation
Upgrade to 7.1.2 and never expose the admin console to the internet.