Missing authorization in GoAnywhere MFT

1) Missing Authorization

EUVDB-ID: #VU85739

Risk: Critical

CVSSv3.1: 9.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C]

CVE-ID: CVE-2024-0204

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing authorization checks related to the InitialAccountSetup.xhtml file along with a path normalization issue. A remote non-authenticated attacker can bypass authentication process and gain full control over the system by creating an administrative account.

Exploit example to access the initial setup page bypassing the authorization check:

https://[host]:8001/goanywhere/images/..;/wizard/InitialAccountSetup.xhtml

Mitigation

Install updates from vendor's website.

Vulnerable software versions

GoAnywhere MFT: 6.0.0 - 7.4.0

External links

http://www.fortra.com/security/advisory/fi-2024-001
http://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml
http://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.