By 
Exploit code is now available for a critical authentication bypass vulnerability in Fortra's GoAnywhere MFT (Managed File Transfer) software which allows attackers to create new admin users on unpatched instances via the administration portal.
GoAnywhere MFT is a web-based managed file transfer tool that helps organizations transfer files securely with partners and keep audit logs of who accessed all shared files.
The bug tracked as CVE-2024-0204 has been patched by Fortra with the release of GoAnywhere MFT 7.4.1.
Fortra also issued private advisories to customers on December 4 before fixing the flaw, urging them to secure their MFT services to keep their data safe.
Admins who have not upgraded to the last version are advised to remove the attack vector by:
Deleting the InitialAccountSetup.xhtml file in the installation directory and restarting the services.
Replacing the InitialAccountSetup.xhtml file with an empty file and restarting the services.
The company reported that there have been no reports of attacks exploiting this vulnerability.
Now, security researchers with Horizon3's Attack Team published a technical analysis of the vulnerability and shared a proof-of-concept (PoC) exploit that helps create new admin users on vulnerable GoAnywhere MFT instances exposed online.
Their exploit takes advantage of the path traversal issue at the root of CVE-2024-0204 to access the vulnerable /InitialAccountSetup.xhtml endpoint and start the initial account setup screen to create a new administrator account.
The easiest indicator of compromise that can be analyzed is for any new additions to the 'Admin users' group in the GoAnywhere administrator portal Users -> Admin Users section.
The researchers stated that if the attacker has left this user here you may be able to observe its last logon activity here to gauge an approximate date of compromise.
However, as the PoC exploit has been released, it's very likely that threat actors will start scanning for and compromise all GoAnywhere MFT instances left unpatched.
While there is no evidence of active exploitation of CVE-2024-0204 in the wild, another flaw in the same product (CVE-2023-0669) was abused by the Cl0p ransomware group to breach nearly 130 victims last year.
