High · published February 7, 2023
CVSS calls it high at 7.2. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.
🚨 A crafty command injection vulnerability can let attackers run their own commands in GoAnywhere MFT before you even log in! 🔥 This is like having a delivery box that opens without verifying the sender—anyone can drop in whatever they want without any checks. Imagine the chaos if that included malicious packages! An attacker could exploit this vulnerability to execute arbitrary commands on the server, potentially leading to data breaches or total system compromise. In short, it’s a gateway for unauthorized access to your sensitive information—absolutely devastating!
This is like having a delivery box that opens without verifying the sender—anyone can drop in whatever they want without any checks. Imagine the chaos if that included malicious packages! This pre-authentication command injection happens in the License Response Servlet, allowing attackers to deserialize an attacker-controlled object and run malicious commands before authentication takes place.
An attacker could exploit this vulnerability to execute arbitrary commands on the server, potentially leading to data breaches or total system compromise. In short, it’s a gateway for unauthorized access to your sensitive information—absolutely devastating! To protect your systems, patch immediately to version 7.1.2. Additionally, review your server configurations to ensure no unauthorized access is possible. Don't wait—this vulnerability is known to be actively exploited! You've got this! Follow these steps, and you’ll be one step closer to locking down your system. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| fortra/goanywhere_managed_file_transfer | < 7.1.2 | 7.1.2 |