CVE-2023-0669

What it actually does

The vulnerability is an insecure deserialization issue in Fortra GoAnywhere Managed File Transfer's License Response Servlet. A network-accessible attacker can send a crafted serialized object to the vulnerable servlet and cause the application to execute attacker-controlled commands in the context of the GoAnywhere/Tomcat service account. Successful exploitation can allow remote code execution, file access, credential theft, creation of new users or persistence mechanisms, data exfiltration, and disruption of managed file transfer operations. Although the supplied CVSS vector indicates high privileges, this issue has been widely described and exploited as a pre-authentication attack path when the vulnerable administrative interface is exposed.

Why it matters to the business

This vulnerability affects a managed file transfer platform that often handles sensitive business data, partner exchanges, financial files, healthcare data, legal records, and other high-value information. Exploitation can result in large-scale data theft, extortion, regulatory reporting obligations, interruption of file transfer workflows, and loss of trust with customers and partners. The risk is especially urgent because it is listed in CISA KEV, has an EPSS score near 1.0, has been exploited in the wild, and has been associated with ransomware/extortion activity. CISA required remediation by 2023-03-03, so any remaining exposed or unpatched instance should be treated as a high-priority incident risk.

How an attack unfolds

An attacker first identifies an internet-exposed or otherwise reachable GoAnywhere MFT administrative interface. They then send a crafted request to the License Response Servlet containing a malicious serialized object. The vulnerable application deserializes that object and triggers command execution on the server. Once code execution is achieved, the attacker can run operating system commands under the GoAnywhere service account, inspect application configuration, access managed file transfer data, steal credentials or keys, create or modify accounts, deploy web shells or scheduled tasks, and stage data for exfiltration. In observed real-world campaigns, exploitation of this vulnerability has been tied to mass data-theft and extortion activity, including ransomware-adjacent operations, so post-exploitation review should assume the attacker’s objective may have been data access and exfiltration rather than only service disruption.

How to fix it

Upgrade Fortra GoAnywhere MFT to version 7.1.2 or later, which patched this issue. If immediate upgrade is not possible, remove internet exposure for the administrative interface, restrict access to trusted administrative networks or VPNs, block access to the vulnerable License Response Servlet at the reverse proxy or WAF, and ensure the GoAnywhere service account has the least privileges necessary. Because this vulnerability has been actively exploited, remediation should include both patching and compromise assessment. Rotate credentials, API keys, SSH keys, encryption keys, and partner-transfer secrets that were accessible to the GoAnywhere application if exploitation is suspected. Review administrative users, external users, transfer workflows, project definitions, triggers, scheduled jobs, and filesystem locations used by GoAnywhere for unauthorized changes.

How to confirm the fix worked

Confirm the installed GoAnywhere MFT version is 7.1.2 or later. Verify that the administrative interface is not publicly reachable and is restricted to authorized management networks. Test that requests to the License Response Servlet are blocked or no longer trigger vulnerable behavior. Review web server, Tomcat, and GoAnywhere application logs around the exposure window for requests to the license servlet and unexpected application errors. Validate that no unauthorized administrative or external users, workflows, triggers, scheduled jobs, startup scripts, web-accessible files, or operating system persistence mechanisms were created. Confirm credential and key rotation was completed where compromise is suspected.

Typical attack path

1. Scan for exposed Fortra GoAnywhere MFT administrative interfaces.
2. Confirm the presence of the vulnerable License Response Servlet endpoint.
3. Send a crafted serialized payload to the License Response Servlet.
4. Trigger command execution in the GoAnywhere/Tomcat service context.
5. Run reconnaissance commands to identify the host, users, configuration files, and accessible file repositories.
6. Access or export managed file transfer data, credentials, keys, or application configuration.
7. Create persistence, such as new application users, web shells, scheduled tasks, or modified startup scripts.
8. Exfiltrate sensitive files and use the access for extortion, lateral movement, or further compromise.

How to detect it

Investigate whether the GoAnywhere administrative interface was reachable from untrusted networks before patching. Review reverse proxy, WAF, load balancer, web access, Tomcat, and GoAnywhere application logs for requests to the License Response Servlet, especially POST requests, unusual serialized payload sizes, 500 errors, stack traces, or requests from unfamiliar IP addresses. On the endpoint, review process telemetry for Java or Tomcat spawning command shells, scripting interpreters, archive tools, curl/wget, PowerShell, certutil, or unusual file-transfer utilities. Examine GoAnywhere audit logs for newly created or modified administrative users, external users, workflows, triggers, scheduled jobs, project definitions, and unexpected downloads or exports. Review outbound network telemetry for unusual large transfers, connections to unfamiliar infrastructure, or staging activity after servlet access. Because this vulnerability has been used in ransomware/extortion-related campaigns, also hunt for ransom notes, data-staging archives, unauthorized bulk exports, and communications referencing data theft. If available, correlate exploitation attempts with known threat activity exploiting Fortra GoAnywhere MFT, including mass data-theft and extortion campaigns.

• /goanywhere/lic/accept
• POST /goanywhere/lic/accept
• GET /goanywhere/lic/accept
• License Response Servlet
• com.linoma.ga.ui.admin.servlet.LicenseResponseServlet
• java.lang.Runtime
• java.lang.ProcessBuilder
• SignedObject.getObject
• cmd.exe /c
• powershell.exe
• /bin/sh -c
• /bin/bash -c
• java.exe spawning cmd.exe
• java.exe spawning powershell.exe
• java spawning /bin/sh
• java spawning /bin/bash
• clop
• cl0p

What your security team should do

• Immediately identify all Fortra GoAnywhere MFT instances, including externally hosted, partner-facing, disaster recovery, and legacy deployments.
• Prioritize emergency remediation for any instance below version 7.1.2, especially if the administrative interface is internet-accessible.
• Treat unpatched internet-exposed systems as potentially compromised due to KEV status, near-certain EPSS likelihood, active exploitation, and ransomware/extortion association.
• Restrict GoAnywhere administrative access to VPN or trusted management networks only; do not expose the admin console directly to the internet.
• Search logs for access to the License Response Servlet and suspicious child processes spawned by Java or Tomcat.
• Review GoAnywhere administrative users, external users, transfer workflows, triggers, schedules, and file repositories for unauthorized activity.
• Perform data-exfiltration review using application transfer logs, web logs, network telemetry, proxy logs, and endpoint artifacts.
• Rotate credentials, SSH keys, API tokens, encryption material, and partner secrets accessible to the GoAnywhere application if exploitation cannot be ruled out.
• Deploy SIEM detections for license servlet access, unexpected Java-spawned command interpreters, new privileged GoAnywhere users, and unusual outbound transfers.
• Document remediation and investigation results because this vulnerability is in CISA KEV and was associated with extortion campaigns.