CVE-2021-27101

What it actually does

CVE-2021-27101 is an unauthenticated SQL injection vulnerability in Accellion FTA 9_12_370 and earlier. A crafted HTTP Host header sent to document_root.html can be interpreted as SQL by the application, allowing a remote attacker to manipulate backend database queries without authentication. Given the CVSS 9.8 rating and network-accessible, low-complexity exploit conditions, successful exploitation can allow disclosure, modification, or destruction of application data and may support follow-on actions such as credential theft, file theft, web shell deployment, and broader compromise when chained with other Accellion FTA vulnerabilities.

Why it matters to the business

Compromise of an Accellion FTA appliance can expose sensitive files handled by the file-transfer platform, disrupt secure file exchange operations, and create regulatory, legal, and extortion risk. This vulnerability is listed in CISA KEV, has been actively exploited in the wild, and is associated with ransomware/extortion activity, so affected internet-facing systems should be treated as high-priority even though the EPSS score is moderate and stable. Because FTA appliances often process externally shared business documents, exploitation can result in data theft rather than only service disruption.

How an attack unfolds

An attacker identifies an internet-accessible Accellion FTA instance running version 9_12_370 or earlier. The attacker sends a specially crafted request to the document_root.html endpoint with SQL syntax embedded in the HTTP Host header. The vulnerable application incorporates that header into a database query without sufficient sanitization, causing attacker-controlled SQL to execute. The attacker may first use benign probes to confirm injection behavior, then issue SQL payloads to enumerate schema details, extract sensitive records, alter application state, or obtain information useful for further compromise. In real-world campaigns against Accellion FTA, exploitation of this vulnerability occurred as part of broader intrusion activity against FTA appliances and was associated with data theft and ransomware/extortion operations; therefore, successful exploitation should prompt investigation for file access, web shell artifacts, credential exposure, and outbound data transfer.

How to fix it

Upgrade Accellion FTA to FTA_9_12_380 or later, as versions 9_12_370 and earlier are affected. If the appliance cannot be upgraded immediately, remove it from direct internet exposure, restrict access to trusted source IPs through a VPN or allowlist, and place compensating controls such as a WAF rule to block SQL metacharacters and keywords in the Host header for requests to document_root.html. Because this vulnerability is KEV-listed and associated with ransomware/extortion activity, mitigation alone should be considered temporary. Accellion FTA is an end-of-life legacy product; where possible, plan migration away from FTA to a supported secure file transfer platform. After patching or migration, rotate credentials and secrets associated with the appliance, review files transferred through the platform, and preserve forensic evidence before rebuilding or decommissioning compromised systems.

How to confirm the fix worked

Confirm the running Accellion FTA version is FTA_9_12_380 or later and that no vulnerable 9_12_370-or-earlier appliances remain externally reachable. Validate that requests to document_root.html with malformed or SQL-like Host headers are rejected or safely handled and do not produce database errors, timing differences, or application exceptions. Review web server and application logs for historic requests to document_root.html where the Host header contains SQL metacharacters, comments, UNION/SELECT keywords, time-delay functions, or encoded equivalents. Confirm no unexpected web-accessible files, web shells, modified application files, unknown administrative users, unusual scheduled jobs, or abnormal outbound transfers are present. If the appliance was internet-facing before remediation, perform incident response validation rather than relying solely on version checks.

Typical attack path

1. Scan the internet or targeted address ranges for exposed Accellion FTA appliances.
2. Fingerprint the FTA version or test for vulnerable behavior on document_root.html.
3. Send a crafted HTTP request to document_root.html with SQL injection content in the Host header.
4. Use error-based, boolean-based, or time-based SQL injection techniques to confirm exploitability.
5. Enumerate database contents or retrieve sensitive application data.
6. Modify database state or gather credentials/session material to support follow-on access.
7. Chain with other appliance vulnerabilities or upload/use a web shell where possible.
8. Stage and exfiltrate files handled by the FTA appliance.
9. Use stolen data for extortion, ransomware negotiation leverage, or follow-on compromise.

How to detect it

Review HTTP access logs, reverse proxy logs, WAF logs, application logs, database logs, endpoint telemetry, and network egress records from Accellion FTA appliances. Focus on requests to document_root.html, especially where the HTTP Host header contains SQL syntax, URL-encoded SQL characters, comments, UNION/SELECT keywords, database metadata references, or time-delay functions. Look for repeated probing with different Host header values, HTTP 500 errors, unusual response sizes, and timing anomalies. Investigate any subsequent access to web-accessible files not expected for the application, especially PHP/HTML files that execute commands or access local files. Review database audit logs for unexpected queries, schema enumeration, authentication table access, or abnormal read volume around the time of suspicious web requests. Examine filesystem timestamps and hashes for modified application files, newly created web shells, staged archives, and temporary files. Review outbound network connections from the appliance for unusual destinations, large transfers, connections to cloud storage, or traffic inconsistent with normal file-transfer workflows. Because exploitation has been associated with ransomware/extortion campaigns, also review data-loss-prevention alerts, file download logs, administrative activity, and any communications or artifacts indicating data theft.

• document_root.html
• /document_root.html
• /courier/document_root.html
• Host: '
• Host: %27
• Host: "
• UNION SELECT
• union select
• information_schema
• @@version
• SLEEP(
• sleep(
• BENCHMARK(
• benchmark(
• WAITFOR DELAY
• --
• /*
• */
• %2f%2a
• %2a%2f
• %2d%2d
• 1=1
• OR 1=1
• or 1=1
• DEWMODE
• /courier/about.html
• about.html
• HTTP 500

What your security team should do

• Immediately identify all Accellion FTA appliances and verify whether any are running 9_12_370 or earlier.
• Patch to FTA_9_12_380 or later, or remove the appliance from service if patching is not possible.
• Treat exposed vulnerable systems as potentially compromised because this is CISA KEV-listed, actively exploited, and associated with ransomware/extortion campaigns.
• Preserve logs and disk images before rebuilding, upgrading, or decommissioning systems to support forensic review.
• Search historic web server, application, database, and network logs for exploitation attempts against document_root.html using malicious Host headers.
• Inspect the appliance for web shells, unexpected files, altered application components, unauthorized accounts, and signs of file staging or exfiltration.
• Rotate credentials, API keys, certificates, and any secrets stored on or used by the FTA appliance.
• Review files transferred through the appliance during the exposure window to assess potential data disclosure.
• Add SIEM detections for SQL injection patterns in Host headers and for requests to known FTA exploitation paths.
• Prioritize migration from legacy Accellion FTA to a supported secure file transfer solution.