CVE-2023-0669
Fortra GoAnywhere MFT Remote Code Execution Vulnerability
Description
CVE-2023-0669 is a high-severity pre-authentication command injection vulnerability in Fortra (formerly HelpSystems) GoAnywhere MFT, specifically in the License Response Servlet. The flaw stems from unsafe deserialization of attacker-controlled objects, allowing remote attackers with high-privilege network access to execute arbitrary commands on the underlying server. With a CVSS v3.1 score of 7.2 and an EPSS score of 94.4% (99.97th percentile), this vulnerability has been extensively exploited in the wild, including by ransomware operators. CISA has added CVE-2023-0669 to the Known Exploited Vulnerabilities catalog and confirmed it as a known ransomware attack vector, making immediate remediation essential for any organization using GoAnywhere MFT. The vulnerability was patched in GoAnywhere MFT version 7.1.2.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| fortra | goanywhere managed file transfer | < 7.1.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis(Exploit, Third Party Advisory)
- https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft(Broken Link, Third Party Advisory)
- https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html(Exploit, Third Party Advisory)
- https://github.com/rapid7/metasploit-framework/pull/17607(Patch)
- https://infosec.exchange/@briankrebs/109795710941843934(Mitigation, Third Party Advisory)
- https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1(Product)
- https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability/(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-0669(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
CVE-2023-0669 is rooted in the deserialization of untrusted data within the License Response Servlet of GoAnywhere MFT. The servlet accepts and processes serialized Java objects from incoming requests without adequate validation, enabling an attacker to supply a specially crafted serialized object that, upon deserialization, triggers arbitrary command execution on the server. This class of vulnerability is particularly dangerous in Java-based applications because it can bypass authentication entirely and grant full system access.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
CVE-2023-0669 carries a CVSS v3.1 score of 7.2 (High severity), reflecting significant risk despite the elevated privilege requirement. Attack Vector (Network): The vulnerability can be exploited remotely over the network, allowing attackers to target internet-facing GoAnywhere MFT installations. Attack Complexity (Low): No special conditions or timing requirements are needed for successful exploitation. Privileges Required (High): The CVSS metric indicates that some level of elevated access is required, though the pre-authentication nature of the flaw in practice has enabled broad exploitation. User Interaction (None): Exploitation is fully automated and requires no action from legitimate users. Scope (Unchanged): The impact is confined to the vulnerable GoAnywhere MFT component. Confidentiality Impact (High), Integrity Impact (High), and Availability Impact (High) indicate that a successful exploit grants the attacker complete control over the GoAnywhere MFT server, including the ability to read sensitive managed file transfer data, modify or delete files, and disrupt transfer operations. The EPSS score of 94.4% (99.97th percentile) places CVE-2023-0669 among the most actively exploited vulnerabilities. CISA has confirmed this as a known ransomware attack vector, with the Cl0p ransomware group notably leveraging it in mass exploitation campaigns against GoAnywhere MFT instances.
Exploit Maturity
Multiple public exploits are available for CVE-2023-0669, including a weaponized proof-of-concept published on Packet Storm Security and a Metasploit module integrated via a Rapid7 pull request. Detailed technical analysis has been published by Rapid7 on AttackerKB and independent researchers. CISA added CVE-2023-0669 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 3, 2023, confirming active exploitation in the wild. CVE-2023-0669 is a confirmed ransomware attack vector, most notably exploited by the Cl0p ransomware group in a large-scale campaign that compromised over 130 organizations through their GoAnywhere MFT installations. The EPSS score of 94.4% (99.97th percentile) reflects near-certain ongoing exploitation activity, consistent with the availability of mature exploit tooling and the high-value nature of managed file transfer systems as targets.
Remediation
- Upgrade GoAnywhere MFT to version 7.1.2 or later immediately as this is the patched release that addresses the deserialization vulnerability in the License Response Servlet. This action is required by CISA's KEV catalog directive, which mandates applying vendor mitigations or discontinuing use of the product.
- Restrict network access to the GoAnywhere MFT administrative console by ensuring it is not directly exposed to the internet. Place the administrative interface behind a VPN or firewall and limit access to only authorized administrator IP addresses.
- Review GoAnywhere MFT logs and system activity for indicators of compromise, including unexpected command execution, unauthorized file access or exfiltration, and anomalous License Response Servlet activity. Given the confirmed ransomware connection, check for evidence of data staging and exfiltration.
- Rotate all credentials and API keys associated with the GoAnywhere MFT environment, including administrator passwords, SFTP keys, and any integration credentials, as attackers may have harvested these during exploitation.
- Implement network segmentation to isolate managed file transfer infrastructure from the broader corporate network. Monitor outbound network traffic from GoAnywhere MFT servers for unusual data transfers that could indicate ongoing exfiltration.
Technical Details
CVE-2023-0669 exploits a deserialization of untrusted data vulnerability (CWE-502) in the License Response Servlet of Fortra GoAnywhere MFT. The servlet, which handles license validation responses, accepts serialized Java objects as input without performing adequate type checking or validation. An attacker can craft a malicious serialized object that, when deserialized by the servlet, triggers a chain of method invocations leading to arbitrary command execution on the underlying operating system. The vulnerability is classified as pre-authentication because the License Response Servlet endpoint can be reached without prior authentication to the GoAnywhere MFT application. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates that exploitation occurs over the network with low complexity. The High privileges-required metric in the CVSS scoring may reflect the intended access model for the License Response Servlet rather than the practical exploitation scenario, as real-world attacks demonstrated that no authentication was needed to reach the vulnerable endpoint. Successful exploitation gives the attacker full control over the GoAnywhere MFT server, including access to all managed file transfers, stored credentials, and the ability to pivot to connected systems.
Frequently Asked Questions
Is CVE-2023-0669 being actively exploited?
Yes, CVE-2023-0669 has been extensively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 3, 2023, and confirmed it as a ransomware attack vector. The Cl0p ransomware group conducted a large-scale campaign exploiting this vulnerability across more than 130 organizations. Multiple public exploits and a Metasploit module are available.
What products are affected by CVE-2023-0669?
CVE-2023-0669 affects Fortra (formerly HelpSystems) GoAnywhere Managed File Transfer (MFT) versions prior to 7.1.2. Any organization running an unpatched GoAnywhere MFT instance with the administrative console accessible over the network is at risk.
How do I fix CVE-2023-0669?
Upgrade GoAnywhere MFT to version 7.1.2 or later immediately. If immediate patching is not possible, restrict network access to the GoAnywhere MFT administrative console and License Response Servlet endpoint. CISA requires federal agencies to apply mitigations or discontinue use of the product.
How severe is CVE-2023-0669?
CVE-2023-0669 has a CVSS v3.1 score of 7.2 (High severity). While the CVSS score reflects a high-privilege requirement, the practical impact has been devastating due to pre-authentication exploitation and its use as a ransomware delivery mechanism. The EPSS score of 94.4% (99.97th percentile) places it among the most actively exploited vulnerabilities globally.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.