A security vulnerability in GoAnywhere MFT, a web-based and managed file transfer tool, has been actively exploited. The exploit code was released by Florian Hauser of Code White, which allows for unauthenticated remote code execution on vulnerable GoAnywhere MFT servers. According to a Shodan scan, almost 1,000 GoAnywhere instances are exposed on the Internet, and Fortra, the developer of the tool, has yet to publicly acknowledge the vulnerability or release security updates to address it. The private advisory provides indicators of compromise, including a specific stacktrace that shows up in the logs on compromised systems. Fortra also recommends implementing access controls to allow access to the GoAnywhere MFT administrative interface only from trusted sources or disabling the licensing service. Additionally, they suggest revoking any credentials stored in the environment, as well as passwords and keys used to access external systems and encrypt files.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 06 Feb 2023 23:41:02 +0000