Watch out, a new critical flaw affects Fortra GoAnywhere MFT

Fortra addressed a new authentication bypass vulnerability impacting GoAnywhere MFT (Managed File Transfer) product.

Fortra warns customers of a new authentication bypass vulnerability tracked as CVE-2024-0204 (CVSS score 9.8), impacting the GoAnywhere MFT (Managed File Transfer) product.

Fortra GoAnywhere Managed File Transfer is a comprehensive solution for secure file transfer, data encryption, and compliance management. It provides a centralized platform for managing and automating file transfers between disparate systems and applications, enabling secure and controlled data movement across an organization’s network.

An unauthorized user can exploit the flaw CVE-2024-0204 to create admin users using the administration portal of the appliance. The flaw was reported by Mohammed Eldeeb & Islam Elrfai from Spark Engineering Consultants on December 1, 2023.

The vulnerability impacts Fortra GoAnywhere MFT 6.x from 6.0.1 and Fortra GoAnywhere MFT 7.4.0 and earlier. Fortra addressed the issue with the release of GoAnywhere MFT 7.4.1.

“Upgrade to version 7.4.1 or higher.” reads the advisory published by the vendor. “The vulnerability may also be eliminated in non-container deployments by deleting the InitialAccountSetup.xhtml file in the install directory and restarting the services. For container-deployed instances, replace the file with an empty file and restart. “

Fortra is not aware of attacks in the wild exploiting this vulnerability.

In February, 2023, the Clop ransomware group claimed to have stolen sensitive data from over 130 organizations by exploiting another zero-day vulnerability (CVE-2023-0669) in Fortra’s GoAnywhere Managed File Transfer secure file transfer tool.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Fortra)