Using GoAnywhere MFT for file transfers? Patch now – an exploit's out for a critical bug

Security experts are wasting no time in publishing working exploits for a critical vulnerability in Fortra GoAnywhere MFT, which was publicly disclosed just over a day ago. Customers were first advised by Fortra on the mitigations for the critical authentication bypass hole in December, and it wasn't publicly revealed for more than a month. Researchers from Horizon3 used the clues left behind in Fortra's public advisory, published on January 22, to develop a working exploit and demonstrate how new admin users could be created by unauthenticated attackers. The exploit targets the vulnerable InitialAccountSetup.xhtml endpoint mentioned in Fortra's January advisory to initiate the admin account setup page. The vulnerability, tracked as CVE-2024-0204, is remotely exploitable and has attracted a 9.8 severity rating. Horizon3's exploit takes advantage of age-old path traversal weaknesses in Tomcat-based applications where requests to vulnerable endpoints that contain /..;/ allow attackers to access forbidden pages, such as the admin account creation page in GoAnywhere MFT. If remote attackers exploit the same path traversal technique when submitting the form to create a new admin user, the account will be created, giving the bad guys admin privileges. The Register approached Fortra for a statement on the vulnerability and emerging exploit, but it did not respond at the time of writing. Zach Hanley, chief attack engineer at Horizon3, said the clearest indicator of compromise would b...