GoAnywhere MFT Authentication Bypass: Unlocking Admin Access Faster Than Your Morning Coffee!
Fortra GoAnywhere MFT 7.4.1 has a hilarious vulnerability: it lets unauthenticated attackers waltz right in and create an admin account, thanks to a path traversal trick. So, if you’re using versions older than 7.4.1, consider upgrading before someone else decides to become an unwelcome admin in your system!
Hot Take:
It looks like Fortra’s GoAnywhere MFT is going nowhere fast with its new CVE-2024-0204 vulnerability. How does one bypass authentication so easily? Well, it seems like the security gate was left ajar, and anyone with a knack for navigating a complex URL can waltz right in and create an admin account. It’s like finding out your front door was just a painted-on illusion!
Key Points:
- Fortra GoAnywhere MFT has a vulnerability in versions prior to 7.4.1.
- The flaw allows unauthenticated attackers to create an admin account.
- Path traversal techniques are used to access the initial account setup wizard.
- Exploit tested on Kali Linux with CVE-2024-0204 as the identifier.
- Two different paths used in the exploit to maximize success across configurations.
Already a member? Log in here