Skip to content

GoAnywhere Active Campaign - 20230331001

Overview

On 01-February-2023, Fortra (formerly HelpSystems) posted a security advisory for a remote pre-authentication remote code execution vulnerability in their GoAnywhere MFT (managed file transfer) solution. Please note that the advisory requires a (free) account in order to view and is not publicly accessible.

This campaign has been related to the CLOP Ransomeware Group.

On 02-February-2023, security reporter Brian Krebs published a warning on Mastodon about an actively exploited zero-day vulnerability for the product and included the contents of the advisory in his post.

What is the vulnerability?

CVE-2023-0669 - CVSS v3 Base Score: 7.2

  • Fortra GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

What is vulnerable?

The vulnerability affects versions below 7.1.2

Recommendation

On 07-February-2023, Forta released patch 7.1.2 to address this actively exploited vulnerability. The WA SOC recommends administrators apply the latest released patches as per vendor instructions to all affected devices.

Additional References