CVE-2024-25156: Fortra GoAnywhere MFT Path Traversal

CVE-2024-25156 Overview

CVE-2024-25156 is a path traversal vulnerability affecting Fortra GoAnywhere Managed File Transfer (MFT) versions prior to 7.4.2. The flaw allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients by manipulating request paths. Classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory), the vulnerability can be exploited over the network without user interaction. Fortra published advisory FI-2024-004 to address the issue in version 7.4.2.

Critical Impact
Attackers can bypass authorization controls on specific endpoints within the GoAnywhere Admin and Web Client interfaces, leading to unauthorized access to protected functionality.

Affected Products

Fortra GoAnywhere Managed File Transfer versions prior to 7.4.2
GoAnywhere Admin Client
GoAnywhere Web Client

Discovery Timeline

2024-03-14 - CVE-2024-25156 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25156

Vulnerability Analysis

The vulnerability resides in how GoAnywhere MFT resolves request paths before enforcing endpoint permission checks. Permission enforcement in the Admin and Web Clients is tied to specific endpoint identifiers. By injecting path traversal sequences into a request, an attacker can reach a protected endpoint while the authorization layer evaluates a different path and permits the request.

This is a classic case of [CWE-22] where input normalization and access control are not aligned. The authorization check operates on the raw or partially normalized path, while the application router resolves the fully traversed path to the real target. The two components arrive at different conclusions about which endpoint is being invoked.

Successful exploitation does not require privileged credentials and can be performed remotely over the network. According to Fortra advisory FI-2024-004, the fix enforces consistent path resolution before permission evaluation.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory within the GoAnywhere Admin and Web Client request handling logic. Permission checks are keyed to specific endpoint paths, but path traversal sequences such as ../ are not stripped or canonicalized before those checks execute. This mismatch allows a crafted URL to pass authorization while reaching a different, protected handler.

Attack Vector

An attacker sends a crafted HTTP request to the GoAnywhere Admin or Web Client with path traversal segments embedded in the URL. The permission check routine evaluates the request as targeting an unprotected endpoint. The web framework then resolves the traversal and dispatches the request to a protected endpoint, bypassing the intended access control.

The vulnerability manifests in the request routing and authorization layer of the GoAnywhere web interfaces. Technical specifics of the vulnerable endpoints are not publicly disclosed. See the Fortra Security Advisory FI-2024-004 for vendor-provided details.

Detection Methods for CVE-2024-25156

Indicators of Compromise

HTTP requests to the GoAnywhere Admin or Web Client containing path traversal sequences such as ../, ..%2f, or ..%5c in the URL path.
Access log entries showing requests that resolve to administrative endpoints from unauthenticated or low-privileged sessions.
Unexpected administrative actions, configuration changes, or file transfer operations without a corresponding privileged login event.

Detection Strategies

Review GoAnywhere access and audit logs for URL patterns containing encoded or raw traversal segments targeting the Admin or Web Client paths.
Correlate web server logs with application audit logs to identify requests where the authorized endpoint differs from the executed endpoint.
Deploy web application firewall (WAF) rules that identify and block path traversal patterns in requests to GoAnywhere interfaces.

Monitoring Recommendations

Enable verbose audit logging on GoAnywhere MFT and forward logs to a centralized SIEM for retention and analysis.
Alert on anomalous administrative API calls originating from non-administrator accounts or unexpected source IP ranges.
Monitor for repeated 4xx responses followed by 2xx responses to similar URLs, which may indicate exploitation attempts.

How to Mitigate CVE-2024-25156

Immediate Actions Required

Upgrade Fortra GoAnywhere MFT to version 7.4.2 or later as directed by Fortra Security Advisory FI-2024-004.
Restrict network access to the GoAnywhere Admin Client to trusted management networks only.
Audit administrative accounts and recent configuration changes for signs of unauthorized activity.

Patch Information

Fortra addressed CVE-2024-25156 in GoAnywhere MFT version 7.4.2. The patch corrects how the Admin and Web Clients normalize request paths before applying endpoint permission checks. Refer to the Fortra Security Advisory FI-2024-004 for release notes and upgrade procedures.

Workarounds

Place the GoAnywhere Admin and Web Client interfaces behind a reverse proxy or WAF that normalizes URLs and blocks path traversal payloads.
Limit exposure of the Admin Client to the public internet; restrict access via IP allowlists or VPN.
Enforce least-privilege account policies to reduce the impact if an attacker reaches a protected endpoint.

bash

# Example NGINX reverse-proxy guard: reject requests containing traversal sequences
location /goanywhere/ {
    if ($request_uri ~* "(\.\./|\.\.%2f|\.\.%5c)") {
        return 403;
    }
    proxy_pass https://goanywhere-backend;
}