CVE-2024-0204

What it actually does

CVE-2024-0204 is a network-exploitable authentication bypass in Fortra GoAnywhere MFT versions prior to 7.4.1. An unauthenticated attacker who can reach the administration portal can access the initial account setup workflow and create a new administrator account. Because the created account has administrative privileges, the attacker can authenticate normally afterward and gain full control of the GoAnywhere MFT administrative interface, including access to managed file-transfer configurations, users, credentials, workflows, audit data, and stored or transferred files. The CVSS 9.8 rating and weaponized exploit maturity reflect that exploitation requires no credentials, no user interaction, and low attack complexity.

Why it matters to the business

Successful exploitation can give an attacker control over a managed file transfer platform, which may expose sensitive files, partner data, credentials, automated transfer jobs, and business workflows. Compromise can result in data theft, tampering with file transfers, unauthorized account creation, operational disruption, regulatory exposure, and downstream impact to business partners that rely on the platform. The very high EPSS score indicates broad likelihood of exploitation in the wild, so internet-exposed administration portals should be treated as high-priority risk even though this CVE is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies a reachable GoAnywhere MFT administration portal. Instead of logging in, the attacker directly requests the vulnerable initial account setup endpoint that should only be available during first-time installation. By abusing the authentication bypass, the attacker submits account creation data and creates a new administrative user. The attacker then logs in through the normal administration portal using the newly created credentials. Once authenticated, the attacker can review configuration, enumerate users and trading partners, access or stage file transfers, retrieve sensitive data, add persistence through additional accounts or configuration changes, and potentially disrupt or manipulate automated transfer workflows.

How to fix it

Upgrade Fortra GoAnywhere MFT to version 7.4.1 or later. If immediate upgrade is not possible, restrict access to the administration portal using VPN, private network access, IP allowlisting, and firewall controls; remove public internet exposure; and apply any vendor-recommended temporary mitigation such as disabling or removing access to the initial account setup workflow where applicable. After patching, review all administrative users, API/service accounts, trading partner configurations, transfer jobs, credentials, and recent administrative changes for unauthorized modifications. Rotate credentials stored in or used by GoAnywhere MFT if compromise is suspected.

How to confirm the fix worked

Confirm the installed GoAnywhere MFT version is 7.4.1 or later. Verify the administration portal is not publicly reachable unless explicitly required and protected by strong access controls. Attempt to access the initial setup workflow from an unauthenticated session and confirm it is not accessible and cannot be used to create an administrator account. Review the administrative user list for unexpected accounts, especially accounts created shortly before or after the patch window. Validate that administrative audit logs show only authorized administrator creation events and expected configuration changes.

Typical attack path

1. Scan for exposed Fortra GoAnywhere MFT administration portals.
2. Send unauthenticated requests to the initial account setup workflow, commonly involving InitialAccountSetup.xhtml.
3. Create a new administrator account without valid credentials.
4. Log in to the GoAnywhere MFT administration portal using the attacker-created admin account.
5. Enumerate users, trading partners, transfer jobs, stored credentials, and accessible files.
6. Exfiltrate sensitive files or configuration data, modify transfer workflows, or create additional persistence.
7. Attempt to delete, alter, or blend into audit records and administrative activity.

How to detect it

Investigate web access logs, reverse proxy logs, load balancer logs, GoAnywhere application logs, and GoAnywhere administrative audit logs for evidence of unauthenticated access to the initial account setup workflow and subsequent administrator logins. Look for requests to InitialAccountSetup.xhtml, especially paths using traversal or path-parameter patterns such as images/..;/wizard/InitialAccountSetup.xhtml. Review audit events for newly created administrator users, password changes, new admin-group membership, unexpected logins, new trading partners, altered projects/workflows, credential access, and bulk file downloads. Correlate any administrator account creation with source IP address, user agent, session ID, and subsequent activity. If suspicious activity is found, examine file transfer logs for unusual download volume, access outside business hours, access from unfamiliar geographies, or transfers involving newly created accounts. Because exploitation creates a legitimate admin account, detection should not rely only on failed logins or malware indicators; focus on account creation and configuration-change audit trails.

• /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml
• /wizard/InitialAccountSetup.xhtml
• InitialAccountSetup.xhtml
• images/..;/wizard/InitialAccountSetup.xhtml
• POST /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml
• GET /goanywhere/images/..;/wizard/InitialAccountSetup.xhtml
• POST /wizard/InitialAccountSetup.xhtml
• GET /wizard/InitialAccountSetup.xhtml
• Created Admin User
• Admin user created
• administrator account created
• new administrator
• Admin Users

What your security team should do

• Immediately inventory all Fortra GoAnywhere MFT instances and determine whether any are running versions prior to 7.4.1.
• Prioritize patching or isolating any instance with an internet-accessible administration portal.
• Upgrade to GoAnywhere MFT 7.4.1 or later and verify the fix by testing unauthenticated access to the setup workflow.
• Search historical web, application, and audit logs for unauthenticated requests to InitialAccountSetup.xhtml and unexpected administrator creation events.
• Review all administrator accounts and remove any unknown or unnecessary users.
• Rotate passwords, API keys, SSH keys, and other credentials stored in or used by GoAnywhere MFT if unauthorized access cannot be ruled out.
• Restrict administration portal access to trusted networks and require strong authentication controls such as MFA where supported.
• Hunt for post-exploitation activity including unusual file downloads, new trading partner definitions, changed transfer jobs, and suspicious scheduled tasks or workflows.
• Preserve logs and forensic artifacts before remediation if compromise is suspected.