Fortra has released an emergency patch to address a security flaw in its GoAnywhere MFT secure file transfer tool that is being actively exploited by attackers. The vulnerability allows them to gain remote code execution on vulnerable GoAnywhere MFT instances whose administrative console is exposed online. The company has warned customers to patch their instances as soon as possible and has provided indicators of compromise to help them identify if their system has been targeted. On Monday, security researcher Florian Hauser of IT security consulting firm Code White also released a proof-of-concept exploit that could be used to achieve unauthenticated remote code execution on Internet-exposed and unpatched GoAnywhere MFT servers. To protect their systems, customers can either apply the security patch or follow Fortra's mitigation advice, which requires implementing access controls to allow access to the admin interface only from trusted sources or disabling the licensing service. If the system has been breached, customers should check if any credentials or keys used to access external systems have been stored and make sure they have been revoked. They should also review relevant access logs related to those systems and check if any passwords or keys used to encrypt files within the system have been compromised.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 07 Feb 2023 08:39:03 +0000