CVE-2021-27103: Accellion FTA SSRF Vulnerability

CVE-2021-27103 Overview

CVE-2021-27103 is a Server-Side Request Forgery (SSRF) vulnerability affecting Accellion FTA (File Transfer Appliance) versions 9_12_411 and earlier. The vulnerability exists in the wmProgressstat.html endpoint, which can be exploited through a specially crafted POST request. This flaw allows remote attackers to induce the server-side application to make HTTP requests to arbitrary domains, potentially leading to unauthorized access to internal resources, data exfiltration, or further compromise of backend systems.

Critical Impact

This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Attackers can leverage this SSRF flaw to access internal services, bypass firewall restrictions, and potentially pivot to additional attacks against protected network resources.

Affected Products

• Accellion FTA versions 9_12_411 and earlier
• All Accellion FTA deployments prior to version FTA_9_12_416
• Enterprise file transfer systems using vulnerable Accellion FTA appliances

Discovery Timeline

• 2021-02-16 - CVE-2021-27103 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2021-27103

Vulnerability Analysis

The SSRF vulnerability in Accellion FTA resides in the wmProgressstat.html endpoint, which fails to properly validate and sanitize user-supplied URL parameters in POST requests. When an attacker sends a maliciously crafted POST request to this endpoint, the application processes the request and initiates server-side HTTP connections to attacker-controlled destinations or internal network resources.

This vulnerability is classified under CWE-918 (Server-Side Request Forgery), which describes scenarios where a web application fetches remote resources based on user-supplied input without proper validation. The impact is severe because the Accellion FTA appliance typically sits at the network perimeter with access to both internal and external networks, making it an ideal pivot point for attackers.

The vulnerability requires no authentication and can be exploited remotely over the network, making it particularly dangerous for internet-exposed Accellion FTA instances.

Root Cause

The root cause of this vulnerability is improper input validation in the wmProgressstat.html endpoint. The application accepts URL parameters in POST requests and uses them to construct server-side HTTP requests without adequately verifying that the target destinations are safe and authorized. This lack of URL validation allows attackers to manipulate the application into making requests to arbitrary internal or external hosts on behalf of the server.

Attack Vector

The attack is executed by sending a crafted POST request to the /wmProgressstat.html endpoint on a vulnerable Accellion FTA instance. The attacker manipulates URL parameters within the POST body to specify internal network addresses or external malicious servers. When the vulnerable server processes the request, it initiates HTTP connections to the attacker-specified destinations.

This SSRF attack can be used to:

• Scan internal network infrastructure to identify services and hosts
• Access internal APIs and services that are not exposed to the internet
• Retrieve sensitive data from internal resources such as cloud metadata endpoints
• Bypass network security controls like firewalls and access control lists
• Deliver malicious payloads to internal systems through the trusted appliance

The vulnerability has been actively exploited in the wild as part of broader attack campaigns targeting Accellion FTA appliances, often chained with other vulnerabilities to achieve full system compromise.

Detection Methods for CVE-2021-27103

Indicators of Compromise

• Unusual outbound HTTP connections from the Accellion FTA appliance to internal network addresses or unexpected external destinations
• Anomalous POST requests to the /wmProgressstat.html endpoint with suspicious URL parameters
• Server logs showing connections to cloud metadata endpoints (e.g., 169.254.169.254) from the FTA appliance
• Evidence of internal network reconnaissance originating from the Accellion FTA server

Detection Strategies

• Monitor web server access logs for POST requests to wmProgressstat.html containing URL-like parameters or IP addresses
• Implement network traffic analysis to identify unexpected outbound connections from the Accellion FTA appliance to internal IP ranges
• Deploy Web Application Firewall (WAF) rules to detect and block SSRF patterns in requests to the FTA application
• Use endpoint detection solutions to alert on suspicious network behavior from file transfer appliances

Monitoring Recommendations

• Enable detailed logging on the Accellion FTA appliance and forward logs to a SIEM for centralized analysis
• Configure alerts for connections from the FTA appliance to sensitive internal resources such as database servers, configuration management systems, or cloud metadata services
• Implement network segmentation monitoring to detect lateral movement attempts originating from the DMZ where the FTA appliance typically resides

How to Mitigate CVE-2021-27103

Immediate Actions Required

• Upgrade Accellion FTA to version FTA_9_12_416 or later immediately to address this vulnerability
• If immediate patching is not possible, restrict network access to the Accellion FTA appliance from untrusted sources
• Review firewall rules to limit outbound connections from the FTA appliance to only necessary destinations
• Conduct a security assessment to identify any signs of prior exploitation

Patch Information

Accellion has released a security update in version FTA_9_12_416 that addresses this SSRF vulnerability along with related security issues. Organizations should update to the fixed version as soon as possible. For additional information, refer to the GitHub CVE-2021-27103 Details and the Accellion FTA Product Page.

Given that this vulnerability is listed in the CISA Known Exploited Vulnerabilities Catalog, federal agencies and organizations following CISA guidance are required to remediate this vulnerability within specified timeframes.

Workarounds

• Implement network-level controls to prevent the Accellion FTA appliance from making outbound connections to internal network ranges
• Deploy a reverse proxy or Web Application Firewall in front of the Accellion FTA to filter and block malicious requests to the vulnerable endpoint
• Restrict access to the wmProgressstat.html endpoint to only authorized users or IP addresses if the functionality is not required
• Consider isolating the Accellion FTA appliance in a restricted network segment with strict egress filtering until patching can be completed

# Example firewall rule to restrict outbound connections from FTA appliance
# Adjust IP ranges and interfaces according to your environment
iptables -A OUTPUT -s <FTA_IP_ADDRESS> -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -s <FTA_IP_ADDRESS> -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -s <FTA_IP_ADDRESS> -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -s <FTA_IP_ADDRESS> -d 169.254.169.254 -j DROP