Known MFT exploits

Specific managed file transfer appliances have been exploited at scale for data theft: MOVEit Transfer, GoAnywhere MFT, CrushFTP, and Serv-U. Each fell to an authentication bypass or injection chain reaching remote code execution or bulk file access. Fingerprinting the product and version maps a target to its known, often unauthenticated, exploit.

1 phút đọccập nhật 5 thg 10, 2026

1 người đóng góp

A handful of MFT products have been the vehicle for large-scale data-theft campaigns, each through an unauthenticated or bypassable flaw that reached remote code execution or bulk file access. They are worth knowing specifically because the products are widely deployed and internet-facing, so fingerprinting one and matching its version frequently maps straight to a usable, high-impact exploit.

MOVEit Transfer: an unauthenticated SQL injection chain leading to file access and code execution, exploited en masse for data theft.
GoAnywhere MFT: an authentication/deserialization flaw in the admin interface giving remote code execution.
CrushFTP: authentication-bypass and related flaws reaching admin and file access.
Serv-U: input-handling flaws reaching code execution or file disclosure.

Using the pattern#

bash

# identify the MFT product and version, then match to its campaign
curl -skI https://<target>/
curl -sk https://<target>/ | grep -iE 'moveit|goanywhere|crushftp|serv-u'

Fingerprint the product and version and match to the specific advisory; most of these are unauthenticated, so reaching the portal is the main precondition. The mechanism classes are on the authentication bypass and injection to RCE pages.

Known MFT exploits

Using the pattern#

References#