Log in Start free

Actively exploited · Published Feb 6, 2023 · Assigned by rapid7

CVE-2023-0669Fortra GoAnywhere MFT License Response Servlet Command Injection

High 7.2 Exploited Ransomware

In plain English

A high-severity unsafe deserialization in Goanywhere MFT from Fortra. Attackers are actively exploiting it in the wild (listed by CISA on February 10, 2023). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)100.0%top 0.0% of all CVEs
Exploited in the wildYesCISA KEV since Feb 10, 2023
Attack tooling3Metasploit, Nuclei, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Mar 3, 2023.

Official description

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
RubyGemsmetasploit-frameworkno fix listedGHSA-6pm2-j2v8-h3cj

Affected products (as reported)

VendorProductVersions
Fortra Goanywhere MFT 0 – through 7.1.1

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References