CVE-2023-0669

CVE-2023-0669: Fortra GoAnywhere MFT Pre-Authentication Command Injection via Deserialization

AI-generated analysis based on the vulnerability data on this page.

Summary

Fortra (formerly HelpSystems) GoAnywhere MFT suffers from a critical pre-authentication command injection vulnerability in the License Response Servlet. The root cause is the deserialization of an arbitrary attacker-controlled object, which can be exploited to achieve remote code execution. This vulnerability was actively exploited in the wild as a zero-day prior to the release of patch 7.1.2.

Background

GoAnywhere MFT is an enterprise managed file transfer solution that supports secure file exchange, automation, and integration workflows. The License Response Servlet is a web-facing component responsible for processing license-related responses. Due to its exposure to the network and its role in handling serialized objects, it became a high-value target for attackers seeking unauthenticated entry points.

Root Cause

The vulnerability is classified under CWE-502: Deserialization of Untrusted Data. The License Response Servlet accepts and deserializes an attacker-controlled object without adequate validation or sanitization. In Java-based applications, insecure deserialization is a well-documented attack vector that can lead to arbitrary code execution when maliciously crafted objects are deserialized by vulnerable classes in the application's classpath. In this case, the attacker is able to inject and execute system commands through the deserialized payload.

Impact

The CVSS v3.1 score of 7.2 (HIGH) reflects the severity of this vulnerability:

• Attack Vector (AV): Network — exploitable remotely without local access.
• Attack Complexity (AC): Low — no special conditions or advanced techniques required.
• Privileges Required (PR): High — exploitation does not require prior authentication.
• User Interaction (UI): None — can be exploited without victim interaction.
• Scope (S): Unchanged — impact is confined to the vulnerable component.
• Confidentiality, Integrity, Availability (C/I/A): All High — successful exploitation grants full control over the target system.

The combination of pre-authentication access and high impact on the CIA triad makes this a critical vulnerability for exposed GoAnywhere MFT instances.

Exploitation Walkthrough

⚠️ Ethics Caveat: This section is provided for defensive and educational purposes only. The information below describes the attack mechanism at a high level to aid detection and mitigation. Do not attempt to exploit systems you do not own or have explicit authorization to test.

1. Reconnaissance: The attacker identifies a publicly accessible GoAnywhere MFT instance, typically via internet scanning for the License Response Servlet endpoint.
2. Payload Crafting: The attacker constructs a serialized Java object designed to trigger unsafe deserialization. The payload is engineered to execute arbitrary system commands upon deserialization.
3. Delivery: The crafted object is sent to the License Response Servlet endpoint. Because the servlet deserializes the input without proper validation, the malicious object is processed.
4. Execution: Upon deserialization, the embedded command is executed on the underlying operating system, granting the attacker remote code execution capabilities.

This is a classic deserialization-based remote code execution (RCE) chain. Defenders should focus on network segmentation, input validation, and patching rather than attempting to reproduce the exploit.

Affected and Patched Versions

Specific vulnerable CPE: cpe:2.3:a:fortra:goanywhere_managed_file_transfer:*:*:*:*:*:*:*:*

Remediation

1. Upgrade Immediately: Organizations running GoAnywhere MFT should upgrade to version 7.1.2 or later without delay. Fortra released this patch specifically to address the zero-day exploitation.
2. Network Segmentation: Restrict network access to GoAnywhere MFT administrative and licensing interfaces. Do not expose these endpoints to the public internet unless absolutely necessary.
3. Web Application Firewall (WAF): Deploy or update WAF rules to detect and block suspicious serialized object payloads directed at the License Response Servlet.
4. Compensating Controls: If immediate patching is not feasible, consider taking the License Response Servlet offline or placing it behind a VPN or jump host to eliminate external exposure.

Detection

• Network Monitoring: Monitor for anomalous HTTP POST requests to the License Response Servlet containing large or unusual payloads that may represent serialized objects.
• Endpoint Detection: Look for unexpected child processes spawned by the GoAnywhere MFT application server (e.g., cmd.exe, powershell.exe, /bin/sh), particularly following HTTP requests to licensing endpoints.
• Log Analysis: Review GoAnywhere MFT access logs for repeated or unusual requests to the License Response Servlet from unexpected source IPs.
• Threat Intelligence: Leverage IOCs from Rapid7, CISA KEV, and EUVD-2023-0644 to enrich detection rules.

Assessment

This vulnerability carries an exceptionally high exploitation probability, as evidenced by an EPSS score of 0.99999 and its inclusion in both the CISA Known Exploited Vulnerabilities catalog and the EUVD registry. The fact that it was exploited as a zero-day before a patch was available underscores the urgency of rapid patching for pre-auth RCE flaws.

Key Lessons:

1. Deserialization is a persistent Achilles' heel in Java applications. Input sanitization and the use of safe deserialization libraries (e.g., allow-listing expected classes) are essential defenses.
2. Zero-day pre-auth RCEs in enterprise file-transfer tools attract immediate adversary attention due to their high value for data exfiltration and ransomware deployment. Internet exposure of such systems should be minimized.

References

• http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html
• https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis
• https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft
• https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html
• https://github.com/rapid7/metasploit-framework/pull/17607
• https://infosec.exchange/@briankrebs/109795710941843934
• https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1
• https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0669