CVE-2023-0669: Fortra GoAnywhere MFT License Response Servlet Command Injection

High severity · published Feb 6, 2023

CVE-2023-0669

Fortra GoAnywhere MFT License Response Servlet Command Injection

RansomwareIn wildKEV

7.2

CVSS

100%

EPSS

Yes

On KEV

Description

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

High

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)100.0% · higher than 100% of CVEs

Exploited in the wildYes

CISA KEVListed Feb 10, 2023

Federal remediation dueMar 3, 2023

Ransomware campaign useKnown

Affected products

Which versions

GoAnywhere MFT · Fortra

through 7.1.1 · source: vendor, KEV

Goanywhere Managed File Transfer · Fortra

before 7.1.2 · source: NVD

Affected product

GoAnywhere MFT

Fortra

All GoAnywhere MFT CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-0669

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-0669

CISA KEV catalogue

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

vendor-advisory

https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1

media-coverage

https://infosec.exchange/@briankrebs/109795710941843934

third-party-advisory

https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/

third-party-advisory

https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis

exploit

https://github.com/rapid7/metasploit-framework/pull/17607

media-coverage

https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft