GoAnywhere MFT was the target of a campaign exploiting a flaw in its administrative interface: a reachable endpoint processed attacker-controlled input in a way that led to insecure deserialization and remote code execution. Where the admin console (or the specific vulnerable servlet) was exposed, which it was in many internet-facing deployments, an attacker reached the vulnerable function and executed code on the appliance, gaining access to the brokered files and the appliance configuration.
# fingerprint GoAnywhere and locate the admin interface
curl -skI https://<target>/ # GoAnywhere headers
curl -sk https://<target>/goanywhere/ -i # admin console path
# the exploit reaches the vulnerable admin endpoint and delivers a deserialization
# payload for RCE; match the GoAnywhere build to the advisory for the endpoint + gadget.
Exploitation notes#
- The entry point is the administrative interface endpoint; exposure of the admin console to untrusted networks is the enabling condition, so internet-facing admin surfaces were the compromised set.
- The mechanism is insecure deserialization leading to code execution, so the payload is a gadget chain for the appliance's framework; see Injection to RCE for the class.
- Code execution lands on the appliance with its service privileges, exposing the transfer files, stored credentials, and configuration; that data is the objective.
- Fingerprint the GoAnywhere build and match the advisory; the vulnerable endpoint and payload are version-specific.