GoAnywhere MFT, a secure web file transfer solution, has warned customers of a zero-day remote code execution vulnerability on exposed administrator consoles. This exploit requires access to the administrative console, which should not normally be accessible from the internet. To mitigate the attack, customers must edit the file /adminroot/WEB INF/web and remove the servlet and servlet-mapping configuration. Fortra, the developers of GoAnywhere, have temporarily shut down their SaaS solution while they work to resolve the bug. Security professional Kevin Beaumont has conducted a Shodan scan to determine how many GoAnywhere instances are exposed on the internet and found 1,008 servers, mainly in the United States. It is important to note that large organizations use this product to transfer sensitive files with their partners, and a single breach could lead to extortion. Fortra has been contacted for more information about whether the attacks are actively exploited, and an update will be provided when a response is received.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Fri, 03 Feb 2023 16:39:02 +0000