CVE-2021-27104
Accellion FTA OS Command Injection Vulnerability
Description
CVE-2021-27104 is a critical-severity OS command injection vulnerability in Accellion FTA (File Transfer Appliance) version 9_12_370 and earlier. The flaw allows unauthenticated attackers to execute arbitrary operating system commands on the server by sending crafted POST requests to various administrative endpoints. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild, and it has been linked to ransomware campaigns. With an EPSS score of 8.9% (92.4th percentile), this Accellion FTA command injection vulnerability was widely targeted as part of a coordinated attack campaign alongside related vulnerabilities CVE-2021-27101, CVE-2021-27102, and CVE-2021-27103.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| accellion | fta | <= 9_12_370 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/accellion/CVEs/blob/main/CVE-2021-27104.txt(Broken Link, Third Party Advisory)
- https://www.accellion.com/products/fta/(Product, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27104(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
OS command injection occurs when software constructs operating system commands using externally-influenced input without properly neutralizing special elements. In the case of Accellion FTA, crafted POST requests to admin endpoints allow attackers to inject shell metacharacters that are passed directly to OS command execution functions, enabling arbitrary command execution with the privileges of the web application process.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Impact Analysis
CVE-2021-27104 carries a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity tier, reflecting the extreme risk it poses. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication and no user interaction, making it trivially exploitable by any network-connected attacker. Successful exploitation grants complete control over the Accellion FTA server, compromising confidentiality, integrity, and availability — attackers can exfiltrate sensitive transferred files, modify system configurations, deploy backdoors, and disrupt file transfer operations. The confirmed use in ransomware operations and the EPSS score of 8.9% underscore the real-world severity, with threat groups like CLOP and UNC2546 having leveraged this vulnerability to steal data from numerous organizations worldwide.
Exploit Maturity
CVE-2021-27104 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, and CISA has flagged it as used in ransomware campaigns. The vulnerability was part of a coordinated exploitation campaign against Accellion FTA appliances in late 2020 and early 2021, where threat actors chained multiple vulnerabilities (CVE-2021-27101, CVE-2021-27102, CVE-2021-27103, CVE-2021-27104) to achieve full system compromise and data exfiltration. The EPSS score of 8.9% (92.4th percentile) indicates significant exploitation activity. Federal agencies were required to remediate by 2021-11-17 per CISA's binding operational directive.
Remediation
- Upgrade Accellion FTA to version FTA_9_12_380 or later immediately as required by CISA KEV. Organizations should note that Accellion has end-of-lifed the FTA product and recommends migrating to Kiteworks (formerly Accellion kiteworks) as the long-term solution.
- If immediate patching is not possible, take the Accellion FTA appliance offline to prevent exploitation. Block all external network access to the FTA administrative endpoints and restrict access to trusted IP addresses only.
- Implement network segmentation to isolate the FTA appliance from critical internal systems, and deploy web application firewall rules to detect and block crafted POST requests containing OS command injection patterns (shell metacharacters such as semicolons, pipes, and backticks).
- Conduct a thorough forensic investigation of the FTA appliance, reviewing web server logs for suspicious POST requests to admin endpoints, checking for unauthorized file access or exfiltration, and scanning for webshells or backdoors that may have been installed during exploitation.
- Plan migration away from Accellion FTA to a supported file transfer solution, as the product has reached end of life. Implement input validation and parameterized command execution practices in any replacement system to prevent OS command injection vulnerabilities.
Technical Details
CVE-2021-27104 is an OS command injection vulnerability in Accellion FTA version 9_12_370 and earlier, exploitable via crafted POST requests to various administrative endpoints. The vulnerability exists because user-supplied input in POST request parameters is incorporated into operating system commands without proper sanitization or neutralization of shell metacharacters. An attacker can inject special characters such as semicolons, pipes, or command substitution syntax to append arbitrary commands that execute in the context of the web server process. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst-case exploitability profile: network-accessible, low complexity, no authentication, and no user interaction required, with maximum impact across all security dimensions.
Frequently Asked Questions
Is CVE-2021-27104 being actively exploited?
Yes. CVE-2021-27104 is listed in the CISA Known Exploited Vulnerabilities catalog and has been confirmed as used in ransomware campaigns. The vulnerability was part of a widespread attack campaign targeting Accellion FTA appliances in 2020-2021, with multiple threat groups leveraging it for data theft and extortion.
What products are affected by CVE-2021-27104?
CVE-2021-27104 affects Accellion FTA (File Transfer Appliance) version 9_12_370 and all earlier versions. The fixed version is FTA_9_12_380 and later. Note that Accellion FTA has reached end of life and migration to a supported platform is recommended.
How do I fix CVE-2021-27104?
Upgrade to Accellion FTA version FTA_9_12_380 or later. However, since the product has reached end of life, organizations should plan migration to Kiteworks or another supported file transfer solution. In the interim, isolate the FTA appliance from external networks and conduct forensic review for indicators of compromise.
How severe is CVE-2021-27104?
CVE-2021-27104 has a CVSS 3.1 score of 9.8 (CRITICAL) and an EPSS score in the 92.4th percentile. The combination of unauthenticated remote exploitation, confirmed ransomware usage, and maximum impact ratings make this one of the most severe file transfer appliance vulnerabilities.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.