CVE-2024-0204: GoAnywhere MFT Auth Bypass Vulnerability

CVE-2024-0204 Overview

CVE-2024-0204 is a critical authentication bypass vulnerability in Fortra's GoAnywhere Managed File Transfer (MFT) solution affecting versions prior to 7.4.1. This vulnerability allows an unauthorized user to create an administrator account via the administration portal without requiring any authentication, effectively granting complete administrative control over the affected system.

Critical Impact

This authentication bypass enables unauthenticated attackers to create administrative accounts on GoAnywhere MFT systems, potentially leading to complete system compromise, data theft, and lateral movement within enterprise networks.

Affected Products

• Fortra GoAnywhere Managed File Transfer versions prior to 7.4.1
• Fortra GoAnywhere Managed File Transfer version 6.0.0 and later
• All GoAnywhere MFT deployments with exposed administration portals

Discovery Timeline

• 2024-01-22 - CVE-2024-0204 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-0204

Vulnerability Analysis

This authentication bypass vulnerability falls under CWE-425 (Direct Request / Forced Browsing), indicating that the GoAnywhere MFT administration portal fails to properly enforce authentication on certain administrative endpoints. The vulnerability allows unauthenticated remote attackers to access functionality that should be restricted to authenticated administrators.

The vulnerability is particularly severe because GoAnywhere MFT is widely deployed in enterprise environments for secure file transfer operations. Organizations use this solution to transfer sensitive data between business partners, customers, and internal systems. Compromise of the MFT platform could expose confidential business documents, personally identifiable information (PII), and other regulated data.

The attack requires no user interaction and can be executed remotely over the network, making it highly exploitable in internet-facing deployments. Once an attacker creates an administrative account, they gain full control over the MFT platform, including the ability to access transferred files, modify system configurations, and potentially pivot to other systems.

Root Cause

The root cause of this vulnerability is a direct request vulnerability (CWE-425) in the GoAnywhere MFT administration portal. The application fails to properly validate authentication state before allowing access to the initial account setup functionality. This allows attackers to directly request administrative account creation endpoints that should only be accessible during initial system setup or by authenticated administrators.

The vulnerability likely stems from improper access control implementation where the application does not adequately verify that the initial setup process has already been completed or that a valid administrative session exists before processing account creation requests.

Attack Vector

The attack vector for CVE-2024-0204 is network-based and requires no privileges or user interaction. An attacker can exploit this vulnerability by directly accessing the GoAnywhere MFT administration portal and navigating to or directly requesting the account creation functionality.

The exploitation process involves an attacker identifying an exposed GoAnywhere MFT administration portal, then crafting requests to the vulnerable endpoint to create a new administrator account with attacker-controlled credentials. Once the administrative account is created, the attacker can authenticate normally and gain full administrative access to the platform.

Technical details regarding the specific exploitation mechanism are available through the Packet Storm Authentication Bypass advisory and related security research. Additionally, remote code execution techniques leveraging this authentication bypass have been documented in the Packet Storm Remote Code Execution advisory.

Detection Methods for CVE-2024-0204

Indicators of Compromise

• Unexpected administrator accounts appearing in the GoAnywhere MFT user management interface
• Authentication logs showing successful admin logins from unusual IP addresses or geographic locations
• Audit trails indicating administrator account creation without corresponding authorized change requests
• Unusual access patterns to transferred files or system configurations by newly created accounts

Detection Strategies

• Review GoAnywhere MFT administrator account listings and investigate any accounts not created through authorized processes
• Monitor authentication logs for the administration portal for suspicious login attempts or successful authentications from unexpected sources
• Implement network monitoring to detect unauthorized access attempts to the GoAnywhere MFT administration portal
• Deploy web application firewall (WAF) rules to detect and block exploitation attempts targeting account creation endpoints

Monitoring Recommendations

• Enable comprehensive audit logging in GoAnywhere MFT to capture all administrative actions and user management activities
• Configure alerts for new administrator account creation events
• Monitor network traffic to GoAnywhere MFT administration ports for anomalous patterns
• Implement Security Information and Event Management (SIEM) correlation rules to detect potential exploitation attempts

How to Mitigate CVE-2024-0204

Immediate Actions Required

• Upgrade GoAnywhere MFT to version 7.4.1 or later immediately
• Audit existing administrator accounts and remove any unauthorized or suspicious accounts
• Restrict network access to the GoAnywhere MFT administration portal to trusted IP addresses only
• Review audit logs for evidence of exploitation prior to patching

Patch Information

Fortra has released version 7.4.1 of GoAnywhere MFT which addresses this authentication bypass vulnerability. Organizations should prioritize upgrading to this version or later as soon as possible. The official security advisory from Fortra is available at the Fortra Security Advisory FI-2024-001.

Additional security advisories and patch information can be found at the GoAnywhere Security Advisories portal.

Workarounds

• Implement network-level access controls to restrict administration portal access to trusted internal networks only
• Deploy a reverse proxy or web application firewall (WAF) in front of the GoAnywhere MFT administration portal to filter malicious requests
• Disable external access to the administration portal entirely if remote administration is not required
• Monitor for and immediately remove any unauthorized administrator accounts while patching is in progress

# Example firewall rule to restrict GoAnywhere MFT admin portal access
# Adjust port numbers based on your deployment configuration
iptables -A INPUT -p tcp --dport 8000 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8000 -j DROP