CVE-2023-0669
HIGH severity · CVSS 7.2 · Insecure deserialization · actively exploited (CISA KEV)
7.2CVSS HIGH exploited ransomware
Actively exploited in the wild (CISA Known Exploited Vulnerabilities).
Known use in ransomware campaigns. Added to KEV 2023-02-10. US federal agencies must patch by 2023-03-03.
Summary
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredHigh
User interactionNone
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit probability (EPSS)100%
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products we track (1)
Recommendation
This vulnerability is being actively exploited in the wild — patch affected products urgently. Open any affected product above for its exact safe version.
Additional information
- NVD record
- https://github.com/rapid7/metasploit-framework/pull/17607Patch
- https://infosec.exchange/@briankrebs/109795710941843934Advisory
- https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/Advisory
- https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mftAdvisory
- https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1
- http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.htmlAdvisory
- https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysisAdvisory
- https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.htmlAdvisory