CVE-2023-0669: 
GoAnywhere MFT vulnerability analysis and mitigation

Fortra GoAnywhere MFT suffered from a pre-authentication command injection vulnerability (CVE-2023-0669) in the License Response Servlet, discovered between January 28-30, 2023. The vulnerability affected version 7.1.1 and earlier versions of the software, allowing attackers to execute remote code through deserializing arbitrary attacker-controlled objects. The issue was patched in version 7.1.2 (Fortra Blog, Sentinel One).

The vulnerability exists in the License Response Servlet of GoAnywhere MFT, where the application deserializes untrusted data without proper validation. The flaw has a CVSS score of 7.2 (High) and requires access to the administrative console for exploitation. The vulnerability stems from the manipulation of an unknown input causing a deserialization vulnerability in the com.linoma.license.gen2.BundleWorker.unbundle method (Frycos Blog, Sentinel One).

When successfully exploited, the vulnerability allows attackers to execute arbitrary code on vulnerable instances of GoAnywhere MFT with system-level privileges. The unauthorized party was able to create unauthorized user accounts in some MFTaaS customer environments and download files from hosted MFTaaS environments. The attacker also installed additional tools like 'Netcat' and 'Errors.jsp' in some customer environments (Fortra Blog).

Fortra released patch version 7.1.2 to address the vulnerability. For immediate mitigation, users were advised to review all administrator users for suspicious activities, rotate Master Encryption Keys, reset all credentials including external trading partners/systems, and review audit logs. Organizations running admin portals exposed to the internet were advised to implement appropriate access controls and limit trusted sources (Fortra Blog).

The vulnerability was initially reported by Brian Krebs on social media, leading to increased awareness in the cybersecurity community. Security researchers, including Kevin Beaumont, noted the significant number of systems exposing administrative ports to the public internet. The incident prompted Fortra to conduct a thorough investigation with Unit 42 and implement continuous improvement actions (Rapid7 Blog).