A security researcher has released proof-of-concept exploit code that can be used to perform unauthenticated remote code execution on vulnerable GoAnywhere MFT servers. GoAnywhere MFT is a web-based and managed file transfer tool designed to help organizations securely transfer files with partners and keep audit logs of who accessed the shared files. The attack vector of this exploit requires access to the administrative console of the application, which is usually only accessible from within a private company network, through VPN, or by allow-listed IP addresses. A Shodan scan shows that almost 1,000 GoAnywhere instances are exposed on the Internet, although just over 140 are on ports 8000 and 8001. Fortra, the developer of the tool, has not yet released security updates to address the vulnerability, leaving all exposed installations vulnerable to attacks. Mitigation advice includes implementing access controls to allow access to the GoAnywhere MFT administrative interface only from trusted sources or disabling the licensing service. Additionally, all credentials used to access external systems with which GoAnywhere is integrated should be revoked and relevant access logs related to those systems should be reviewed.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 06 Feb 2023 23:23:03 +0000