Fortra GoAnywhere MFT zero-day vulnerability lets hackers breach servers

guest · Feb 3, 2023

By Bill Toulas @billtoulas - February 3, 2023

The developers of the GoAnywhere MFT file transfer solution are warning customers of zero-day remote code execution vulnerability on exposed administrator consoles.
Click to expand...

GoAnywhere is a secure web file transfer solution that allows companies to securely transfer encrypted files with their partners while keeping detailed audit logs of who accessed the files.

The GoAnywhere security advisory was first made public by reporter Brian Krebs, who posted a copy on Mastodon.
A customer who received the notification told BleepingComputer that this is affecting both the on-premise and SaaS implementations of GoAnywhere but we could not independently confirm this at this time.
Click to expand...

According to the security advisory, the exploit requires access to the administrative console, which should not normally be exposed to the internet.

"A Zero-Day Remote Code Injection exploit was identified in GoAnywhere MFT," warns the GoAnywhere security advisory.
"The attack vector of this exploit requires access to the administrative console of the application, which in most cases is accessible only from within a private company network, through VPN, or by allow-listed IP addresses (when running in cloud environments, such as Azure or AWS)."
Security professional Kevin Beaumont has performed a Shodan scan to determine how many GoAnywhere instances are exposed on the internet and found 1,008 servers, mainly in the United States.
Click to expand...

While the attack surface may appear limited, it's important to note that large organizations use these products to transfer sensitive files with their partners.
Click to expand...

guest · Feb 6, 2023

Exploit released for actively exploited GoAnywhere MFT zero-day
By Sergiu Gatlan @serghei - February 6, 2023

Exploit code has been released for an actively exploited zero-day vulnerability affecting Internet-exposed GoAnywhere MFT administrator consoles.
Click to expand...

GoAnywhere MFT is a web-based and managed file transfer tool designed to help organizations to transfer files securely with partners and keep audit logs of who accessed the shared files.

Its developer is Fortra (formerly known as HelpSystems), the outfit behind the widely abused Cobalt Strike threat emulation tool.
Click to expand...

On Monday, security researcher Florian Hauser of IT security consulting firm Code White released technical details and proof-of-concept exploit code that performs unauthenticated remote code execution on vulnerable GoAnywhere MFT servers.

"I could provide a working PoC (compare hash and time of my tweet) to my teammates within hours on the same day to protect our clients first," Hauser said.
Fortra says that "the attack vector of this exploit requires access to the administrative console of the application, which in most cases is accessible only from within a private company network, through VPN, or by allow-listed IP addresses (when running in cloud environments, such as Azure or AWS)."
Click to expand...

However, a Shodan scan shows that almost 1,000 GoAnywhere instances are exposed on the Internet, although just over 140 are on ports 8000 and 8001 (the ones used by the vulnerable admin console).
Click to expand...

guest · Feb 10, 2023

GoAnywhere MFT Zero-Day Exploitation Linked to Ransomware Attacks
By Eduard Kovacs @EduardKovacs - February 10, 2023

The recent exploitation of a zero-day vulnerability in the GoAnywhere managed file transfer (MFT) software has been linked by a cybersecurity firm to a known cybercrime group that has likely attempted to exploit the flaw in a ransomware attack.
Click to expand...

On February 1, Fortra alerted GoAnywhere MFT users about a zero-day remote code injection exploit. The vendor immediately provided indicators of compromise (IoCs) and mitigations, but released a patch only a week later.
Users, particularly those who are running an admin portal that is exposed to the internet, have been instructed to urgently install the patch.

No information was made available about the attacks exploiting the vulnerability, but managed endpoint detection and response firm Huntress reported this week that these attacks may have been conducted by a known cybercrime group.
Click to expand...

Huntress has linked the attack to a malware family named Truebot, which was previously associated with a Russian-speaking threat actor named Silence. This group has also been linked to TA505, a threat group known for distributing the notorious Cl0p ransomware.

“Based on observed actions and previous reporting, we can conclude with moderate confidence that the activity Huntress observed was intended to deploy ransomware, with potentially additional opportunistic exploitation of GoAnywhere MFT taking place for the same purpose,” Huntress said in a blog post.
Click to expand...

Huntress: Investigating Intrusions From Intriguing Exploits

By Joe Slowik - February 8, 2023
By investigating the event in question and pursuing root cause analysis (RCA), Huntress was able to link this intrusion to a recently-announced vulnerability as well as to a long-running post-exploitation framework linked to prominent ransomware groups. As a result of a combination of quick initial triage and action with deeper investigation, Huntress was able to mitigate and prevent an intrusion likely leading to a disruptive ransomware incident.
Click to expand...

guest · Feb 10, 2023

mood said: ↑

GoAnywhere MFT Zero-Day Exploitation Linked to Ransomware Attacks
By Eduard Kovacs @EduardKovacs - February 10, 2023

Huntress: Investigating Intrusions From Intriguing Exploits
Click to expand...

Clop ransomware claims to be behind GoAnywhere zero-day attacks
By Sergiu Gatlan @serghei - February 10, 2023

The Clop ransomware gang claims to be behind recent attacks that exploited a zero-day vulnerability in the GoAnywhere MFT secure file transfer tool, saying they stole data from over 130 organizations.

The security flaw, now tracked as CVE-2023-0669, enables attackers to gain remote code execution on unpatched GoAnywhere MFT instances with their administrative console exposed to Internet access.
Click to expand...

Clop reached out to BleepingComputer and told us that they had allegedly stolen the data over the course of ten days after breaching servers vulnerable to exploits targeting this bug.

However, the gang refused to share additional details regarding their claims when BleepingComputer asked them when the attacks began, if they'd already started extorting their victims, and what ransoms they were asking for.
Click to expand...

They also claimed that they could move laterally through their victims’ networks and deploy ransomware payloads to encrypt their systems but decided against it and only stole the documents stored on the compromised GoAnywhere MFT servers.
Click to expand...

Log in or Sign up

Fortra GoAnywhere MFT zero-day vulnerability lets hackers breach servers

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Fortra GoAnywhere MFT zero-day vulnerability lets hackers breach servers

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches