A recently discovered security flaw in Fortras GoAnywhere MFT managed file transfer application is being actively exploited in the wild. The vulnerability was first reported by security reporter Brian Krebs on Mastodon. It is a type of remote code injection that requires access to the administrative console of the application, so it is important that the systems are not exposed to the public internet. According to security researcher Kevin Beaumont, there are over 1,000 on-premise instances that are publicly accessible, mostly in the U.S. Fortra's advisory suggests that customers should review all administrative users and watch for any unrecognized usernames, especially those created by the system. This implies that Fortra is likely seeing follow-up attacks that involve the creation of new administrative or other users to take control of or maintain access to vulnerable target systems. The cybersecurity company said it is possible for malicious actors to exploit reused, weak, or default credentials to gain administrative access to the console. Unfortunately, there is no patch available for the zero-day vulnerability yet, although Fortra has released workarounds to remove the License Response Servlet configuration from the web. Vulnerabilities in file transfer solutions have become attractive targets for attackers, with flaws in Accellion and FileZen being used for data theft and extortion.
This Cyber News was published on thehackernews.com. Publication date: Sat, 04 Feb 2023 05:54:02 +0000