CVE-2025-3871 Overview
CVE-2025-3871 is a broken access control vulnerability [CWE-862] in Fortra's GoAnywhere Managed File Transfer (MFT) prior to version 7.8.1. The flaw affects deployments configured to use GoAnywhere One-Time Password (GOTP) email two-factor authentication (2FA). An unauthenticated remote attacker can trigger a denial of service against a known user account by supplying that user's email address at the 2FA prompt when the target account has not configured an email address. The affected user account becomes disabled if they have GOTP configured, preventing legitimate access.
Critical Impact
Unauthenticated attackers can remotely disable known GoAnywhere MFT user accounts, creating a targeted denial of service against file transfer operations.
Affected Products
- Fortra GoAnywhere MFT versions prior to 7.8.1
- Deployments configured with GoAnywhere One-Time Password (GOTP) email 2FA
- User accounts with GOTP configured but without an email address set
Discovery Timeline
- 2025-07-16 - CVE-2025-3871 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-3871
Vulnerability Analysis
The vulnerability originates in the GOTP email 2FA workflow of GoAnywhere MFT. The application performs an authorization check that fails to properly validate the relationship between the submitted email address and the target user account. When a user has GOTP enabled but no email address on file, the 2FA logic accepts an attacker-supplied email address as an input during the challenge step.
Rather than rejecting the input or issuing a benign failure, the application treats the mismatch as a security event and disables the user account. This turns an authentication control into a self-inflicted denial of service primitive. The attacker only needs knowledge of a valid username to disable accounts one at a time.
The issue is classified as Missing Authorization [CWE-862] because the workflow lacks a check ensuring the 2FA email input belongs to the requesting session or matches the account's stored email.
Root Cause
The root cause is broken access control in the 2FA challenge handler. The handler does not verify that the email address supplied at the prompt is bound to the user record, nor does it require prior authentication before enabling account-disabling side effects.
Attack Vector
Exploitation is network-based, requires no privileges, and requires no user interaction. An attacker reaches the GoAnywhere MFT login interface, enters a known username, and at the GOTP email prompt submits the email address of another known user. If that target user has GOTP enabled and no email address stored, the account is disabled.
Code examples are not published for this issue. Refer to the Fortra Security Advisory FI-2025-009 for vendor-provided technical details.
Detection Methods for CVE-2025-3871
Indicators of Compromise
- Unexpected account status changes to disabled on GoAnywhere MFT user records, particularly for accounts configured with GOTP but without a stored email address.
- Repeated 2FA prompt submissions originating from external IP addresses targeting known usernames.
- Audit log entries showing account-disable events immediately following an email 2FA challenge.
Detection Strategies
- Correlate GoAnywhere MFT authentication audit logs with account state transitions to identify accounts disabled during 2FA flows.
- Alert on multiple failed 2FA email submissions from a single source IP across distinct usernames within a short interval.
- Monitor for enumeration patterns targeting the GoAnywhere login endpoint, including sequential username submissions.
Monitoring Recommendations
- Forward GoAnywhere MFT application and admin audit logs to a centralized SIEM for retention and correlation.
- Establish a baseline of legitimate account-disable events and alert on deviations, especially outside administrator working hours.
- Track help desk tickets related to unexpected account lockouts and cross-reference with authentication logs.
How to Mitigate CVE-2025-3871
Immediate Actions Required
- Upgrade all GoAnywhere MFT instances to version 7.8.1 or later.
- Audit user accounts configured with GOTP email 2FA and ensure each has a valid email address populated.
- Restrict network exposure of the GoAnywhere MFT login interface to trusted networks or a VPN where feasible.
- Review audit logs for prior account-disable events consistent with exploitation of this flaw.
Patch Information
Fortra addressed the vulnerability in GoAnywhere MFT 7.8.1. Administrators should follow the guidance in the Fortra Security Advisory FI-2025-009 to plan and apply the update.
Workarounds
- Populate an email address for every user account that has GOTP enabled to remove the vulnerable precondition.
- Temporarily disable GOTP email 2FA for accounts that cannot have an email address assigned, and enforce an alternate 2FA method.
- Place the GoAnywhere MFT web interface behind a reverse proxy or WAF that restricts access to authorized source IP ranges until patching is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
