CVE-2021-27103
Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability
Description
CVE-2021-27103 is a critical-severity server-side request forgery (SSRF) vulnerability in Accellion FTA (File Transfer Appliance) version 9_12_411 and earlier. The flaw allows an unauthenticated attacker to send crafted POST requests to the wmProgressstat.html endpoint, coercing the server into making arbitrary requests to internal or external resources. CISA has confirmed active exploitation of this Accellion FTA vulnerability and added it to the Known Exploited Vulnerabilities catalog, with known ransomware campaign associations. With an EPSS score of 2.87% (86.1st percentile), CVE-2021-27103 represents a significant exploitation risk that demands immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| accellion | fta | < 9_12_416 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/accellion/CVEs/blob/main/CVE-2021-27103.txt(Broken Link, Product)
- https://www.accellion.com/products/fta/(Product)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27103(US Government Resource)
Weakness Type
CWE-918: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery occurs when a web application fetches a remote resource without validating the user-supplied URL. In the case of Accellion FTA, the wmProgressstat.html endpoint processes attacker-controlled input to make server-side requests, allowing adversaries to access internal services, cloud metadata endpoints, or interact with internal APIs that should not be externally reachable.
Learn more: CWE-918 — Server-Side Request Forgery (SSRF)
Impact Analysis
CVE-2021-27103 carries a CVSS 3.1 score of 9.8 (CRITICAL), reflecting an exceptionally dangerous vulnerability profile. The SSRF vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication or privileges, and demands no user interaction. Successful exploitation can lead to full compromise of confidentiality, integrity, and availability of the affected Accellion FTA system and potentially connected internal resources. Because SSRF allows the appliance to be weaponized as a proxy into internal networks, attackers can pivot to access backend databases, cloud metadata services, or other sensitive infrastructure that would otherwise be unreachable from the internet. The confirmed association with ransomware campaigns significantly elevates the risk, as threat actors have used this vulnerability as part of broader attack chains targeting Accellion FTA deployments to steal sensitive data and extort victims.
Exploit Maturity
CVE-2021-27103 is confirmed as actively exploited through its inclusion in the CISA Known Exploited Vulnerabilities catalog, and CISA has flagged this vulnerability as having known associations with ransomware campaigns. The EPSS score of 2.87% (86.1st percentile) indicates a notable probability of ongoing exploitation. This SSRF vulnerability was part of a broader set of Accellion FTA vulnerabilities (CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104) that were chained together by the Clop ransomware group and UNC2546/FIN11 threat actors to conduct large-scale data theft and extortion campaigns in early 2021. Federal agencies were required to remediate by 2021-11-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions. Upgrade Accellion FTA to version FTA_9_12_416 or later, which addresses the SSRF vulnerability in the wmProgressstat.html endpoint.
- Decommission Accellion FTA if possible, as Accellion (now Kiteworks) has end-of-lifed the FTA product. Migrate to a supported secure file transfer solution to eliminate ongoing risk from this legacy platform.
- Implement network segmentation and firewall rules to restrict the Accellion FTA appliance from making outbound requests to internal services and cloud metadata endpoints (169.254.169.254). Block unnecessary URL schemes and validate all server-side request destinations.
- Monitor network traffic logs for unusual outbound connections from the FTA appliance, particularly requests to internal IP ranges or cloud metadata services. Review web server access logs for suspicious POST requests to wmProgressstat.html.
- Conduct a thorough forensic investigation to determine if the vulnerability was exploited prior to patching, as this CVE was part of a widely exploited attack chain. Check for indicators of compromise associated with Clop ransomware and FIN11 activity.
Technical Details
CVE-2021-27103 is a server-side request forgery vulnerability in Accellion FTA version 9_12_411 and earlier, triggered through a crafted POST request to the wmProgressstat.html endpoint. The application fails to validate or sanitize user-supplied URL parameters, allowing an attacker to coerce the FTA server into initiating HTTP requests to arbitrary internal or external destinations. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that this vulnerability is network-accessible, trivially exploitable, and requires neither authentication nor user interaction, resulting in maximum impact across all three security objectives. The SSRF primitive enables attackers to bypass network perimeter defenses by using the FTA appliance itself as a trusted proxy to reach internal services, enumerate infrastructure, and exfiltrate data from systems that would otherwise be inaccessible from the internet.
Frequently Asked Questions
Is CVE-2021-27103 being actively exploited?
Yes. CVE-2021-27103 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. CISA has also flagged this vulnerability as having known associations with ransomware campaigns. The EPSS score of 2.87% (86.1st percentile) further indicates a notable exploitation probability.
What products are affected by CVE-2021-27103?
CVE-2021-27103 affects Accellion FTA (File Transfer Appliance) versions prior to FTA_9_12_416. Specifically, all versions 9_12_411 and earlier are vulnerable. The Accellion FTA product has been end-of-lifed and organizations are strongly advised to migrate to a supported file transfer solution.
How do I fix CVE-2021-27103?
Upgrade Accellion FTA to version FTA_9_12_416 or later. However, since the product has been discontinued, the recommended long-term remediation is to decommission FTA entirely and migrate to a supported secure file transfer platform. In the interim, restrict the appliance's ability to make outbound connections to internal resources.
How severe is CVE-2021-27103?
CVE-2021-27103 has a CVSS 3.1 score of 9.8 (CRITICAL), placing it among the most severe vulnerabilities. It requires no authentication or user interaction and can be exploited remotely. The confirmed ransomware associations and its role in the 2021 Accellion FTA attack campaign make this an extremely high-priority vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.