Critical Vulnerability in Fortra GoAnywhere MFT

Summary

Vulnerability CVE-2024-0204 has been found in Fortra GoAnywhere Managed File Transfer software. It allows an unauthorized user to create an admin account via its administration portal. This gives the attacker administrative rights over the tool, allowing them to execute commands, edit configurations, upload files, and more. Horizon3ai has created PoC exploit code for this vulnerability to help the security professionals develop a patch or other mitigation measure to address the issue.

Impact Assessment

Forta has designated this vulnerability a CVSS 3.1, with a base score of 9.8 Critical. Proof-of-concept exploit code exists and uses a weakness in MFT’s path traversal. There is no proof that CVE-2024-0204 has been exploited in the wild, but a ransomware attack was successful against the same MFT application last year. Due to the high base score and the existence of proof-of-concept code, this vulnerability has a high risk of exploitation.

What it means for you

Check if your environment contains Forta MFT and if it does, remediate as necessary.

Remediation

Update your instance of Fortra GoAnywhere MFT to version 7.4.1 or higher to remediate this vulnerability.

Mitigate: If upgrading to 7.4.1 is not an option for your organization, mitigation techniques are available for container and non-container deployments, as follows:

• This vulnerability can be eliminated in non-container deployments by deleting the InitialAccountSetup.xhtml file in the install directory and restarting the services.
• This vulnerability can be eliminated in container deployed instances by replacing the InitialAccountSetup.xhtml file with an empty one and restarting.

Business Implications

The presence of this vulnerability in any environment should be a priority concern. If exploited, disruption of your organization’s data and day-to-day operations would likely ensue, leading to monetary loss, data loss or leakage, which could hurt your business’ reputation.

Access Point Technology Recommends

Patch: If your organization's version of Forta MFT is below 7.4.1, upgrade to the latest version. Follow the above remediation section with mitigations.

Associated Bulletins

https://www.fortra.com/security/advisory/fi-2024-001

https://github.com/horizon3ai/CVE-2024-0204/blob/main/README.md

https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/