Forta GoAnywhere Zero-Day CVE-2023-0669 Exploited | Qualys

Summary: On February 1, 2023, Fortra released an advisory behind an auth wall notifying customers of a remote code execution zero-day in its GoAnywhere Managed File Transfer application, assigned CVE-2023-0669; version 7.1.2 fixing the flaw followed on February 7, 2023. The vulnerability stems from improper sanitization of serialized data and requires access to the administrative console, which is typically reachable only from a private network, VPN, or allow-listed IPs, though Shodan shows many such instances exposed to the internet.
What you should know: The admin console that exploitation depends on was assumed to be shielded by network position, yet Shodan shows many GoAnywhere instances sitting directly on the internet, and adversaries are using Truebot-styled persistence via Scheduled Tasks and Rundll32 once inside.

Read the original at Qualys Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-0669
Related: CVE-2023-0669: Fortra GoAnywhere MFT Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Feb 10, 2023
Threat Source newsletter (Feb. 23, 2023) — Social media sites are making extra security a paid feature Cyber Risks ·
Dragos Industrial Ransomware Attack Analysis: Q1 2023 Cyber Risks ·