Summary
Vulnerability CVE-2024-0204 has been found in Fortra GoAnywhere Managed File Transfer software. It allows an unauthorized user to create an admin account via its administration portal. This gives the attacker administrative rights over the tool, allowing them to execute commands, edit configurations, upload files, and more. Horizon3ai has created PoC exploit code for this vulnerability to help the security professionals develop a patch or other mitigation measure to address the issue.
Impact Assessment
Forta has designated this vulnerability a CVSS 3.1, with a base score of 9.8 Critical. Proof-of-concept exploit code exists and uses a weakness in MFT’s path traversal. There is no proof that CVE-2024-0204 has been exploited in the wild, but a ransomware attack was successful against the same MFT application last year. Due to the high base score and the existence of proof-of-concept code, this vulnerability has a high risk of exploitation.
What it means for you
Check if your environment contains Forta MFT and if it does, remediate as necessary.
Remediation
Update your instance of Fortra GoAnywhere MFT to version 7.4.1 or higher to remediate this vulnerability.
Mitigate: If upgrading to 7.4.1 is not an option for your organization, mitigation techniques are available for container and non-container deployments, as follows:
- This vulnerability can be eliminated in non-container deployments by deleting the InitialAccountSetup.xhtml file in the install directory and restarting the services.
- This vulnerability can be eliminated in container deployed instances by replacing the InitialAccountSetup.xhtml file with an empty one and restarting.
Business Implications
The presence of this vulnerability in any environment should be a priority concern. If exploited, disruption of your organization’s data and day-to-day operations would likely ensue, leading to monetary loss, data loss or leakage, which could hurt your business’ reputation.
Access Point Technology Recommends
Patch: If your organization's version of Forta MFT is below 7.4.1, upgrade to the latest version. Follow the above remediation section with mitigations.
Associated Bulletins
https://www.fortra.com/security/advisory/fi-2024-001
https://github.com/horizon3ai/CVE-2024-0204/blob/main/README.md
https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
.webp)
.png)
