Withdrawn: Fortra GoAnywhere MFT Deserialization of Untrusted Data vulnerability affects metasploit-framework
GHSA-6pm2-j2v8-h3cj · CVE-2023-0669
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Withdrawn
This advisory has been withdrawn because it was incorrectly associated with the metasploit-framework package, which is not affected by this CVE, and the actual vulnerable component does not fit within our supported ecosystems. This link is maintained to preserve external references.
Original Description
Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2023-0669
- WEB https://github.com/rapid7/metasploit-framework/pull/17607
- WEB https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis
- WEB https://duo.com/decipher/fortra-patches-actively-exploited-zero-day-in-goanywhere-mft
- WEB https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html
- PACKAGE https://github.com/rapid7/metasploit-framework
- WEB https://infosec.exchange/@briankrebs/109795710941843934
- WEB https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml#zerodayfeb1
- WEB https://www.rapid7.com/blog/post/2023/02/03/exploitation-of-goanywhere-mft-zero-day-vulnerability
- WEB http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html
Ready to move
Start Securing
Free, no credit card | First findings in minutes