CVE-2021-27102
Accellion FTA OS Command Injection Vulnerability
Description
CVE-2021-27102 is a high-severity OS command injection vulnerability in Accellion FTA (File Transfer Appliance) version 9_12_411 and earlier. The flaw allows an attacker with local access to execute arbitrary operating system commands through a local web service call. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and it has been linked to ransomware campaigns. This Accellion FTA command injection vulnerability was exploited as part of a coordinated attack chain alongside CVE-2021-27101, CVE-2021-27103, and CVE-2021-27104, enabling threat actors to achieve full system compromise after initial access.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| accellion | fta | <= 9_12_411 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/accellion/CVEs/blob/main/CVE-2021-27102.txt(Broken Link, Third Party Advisory)
- https://www.accellion.com/products/fta/(Product, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27102(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OS command injection occurs when software constructs operating system commands using externally-influenced input without properly neutralizing special elements. In the case of CVE-2021-27102, a local web service call in Accellion FTA passes user-controlled input to OS command execution functions without adequate sanitization, allowing an attacker who has gained initial access to the appliance to escalate their control by executing arbitrary system commands.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Impact Analysis
CVE-2021-27102 carries a CVSS 3.1 score of 7.8 (HIGH), representing a serious post-exploitation threat. Unlike its companion vulnerability CVE-2021-27104, this flaw requires local access and low-level privileges to exploit, but involves no user interaction and low attack complexity. Once exploited, the impact is severe across all dimensions: confidentiality, integrity, and availability are all rated HIGH, meaning an attacker can access sensitive files stored on the FTA appliance, modify system configurations, and disrupt file transfer services. This vulnerability was typically chained with CVE-2021-27101 (SQL injection for initial access) to achieve privilege escalation and full system control. CISA has confirmed its use in ransomware operations, emphasizing the critical need for remediation.
Exploit Maturity
CVE-2021-27102 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, and CISA has flagged it as used in ransomware campaigns. This vulnerability served as a privilege escalation component in the broader Accellion FTA attack chain, where threat actors first gained initial access through CVE-2021-27101 (SQL injection) or CVE-2021-27104 (remote command injection), then used CVE-2021-27102 to execute additional commands via local web service calls. The EPSS score of 0.28% (51.3rd percentile) is relatively low in isolation, reflecting that exploitation requires prior local access, but the vulnerability's role in a proven attack chain makes it a confirmed active threat. Federal agencies were required to remediate by 2021-11-17.
Remediation
- Upgrade Accellion FTA to version FTA_9_12_416 or later immediately as required by CISA KEV. Note that Accellion has end-of-lifed the FTA product and recommends migration to Kiteworks as the long-term replacement.
- If immediate patching is not feasible, take the Accellion FTA appliance offline to prevent any exploitation chain that could lead to local command execution. Disable or restrict access to the internal web service endpoints used by this vulnerability.
- Implement strict network segmentation to isolate the FTA appliance from internal systems, and ensure that only essential services are accessible. Apply firewall rules to block unauthorized local service calls and limit inter-process communication on the appliance.
- Conduct comprehensive forensic analysis of the FTA appliance, focusing on web service call logs, process execution history, and file integrity checks. Look for indicators of compromise including unauthorized file access, data exfiltration artifacts, and persistence mechanisms such as webshells or cron jobs.
- Migrate to a supported file transfer platform as Accellion FTA has reached end of life. Ensure the replacement solution follows secure coding practices including parameterized command execution and input validation to prevent OS command injection.
Technical Details
CVE-2021-27102 is an OS command injection vulnerability in Accellion FTA version 9_12_411 and earlier that is exploitable through a local web service call. The vulnerability exists because input passed to an internal web service endpoint is incorporated into operating system commands without proper neutralization of shell metacharacters. An attacker who has gained local access to the FTA appliance — typically through prior exploitation of a remote vulnerability such as CVE-2021-27101 — can leverage this flaw to execute arbitrary commands with elevated privileges. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates local access with low privileges is required, but the exploitation itself is straightforward with no user interaction needed and maximum impact across confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2021-27102 being actively exploited?
Yes. CVE-2021-27102 is listed in the CISA Known Exploited Vulnerabilities catalog and has been confirmed as used in ransomware campaigns. It was exploited as part of a multi-vulnerability attack chain targeting Accellion FTA appliances alongside CVE-2021-27101, CVE-2021-27103, and CVE-2021-27104.
What products are affected by CVE-2021-27102?
CVE-2021-27102 affects Accellion FTA (File Transfer Appliance) version 9_12_411 and all earlier versions. The fixed version is FTA_9_12_416 and later. The Accellion FTA product has reached end of life.
How do I fix CVE-2021-27102?
Upgrade to Accellion FTA version FTA_9_12_416 or later. Since the product has reached end of life, organizations should migrate to Kiteworks or another supported file transfer solution. Conduct forensic analysis to determine if the vulnerability was exploited prior to patching.
How severe is CVE-2021-27102?
CVE-2021-27102 has a CVSS 3.1 score of 7.8 (HIGH). While it requires local access to exploit, its role as a privilege escalation step in a proven ransomware attack chain makes it a critical remediation priority for any organization running Accellion FTA.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.