{"id":55185,"date":"2024-01-24T14:53:53","date_gmt":"2024-01-24T14:53:53","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/35433\/CVE-2024-0204-Fortra-GoAnywhere-MFT-Authentication-Bypass-Deep-Dive.html"},"modified":"2024-01-24T14:53:53","modified_gmt":"2024-01-24T14:53:53","slug":"cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive\/","title":{"rendered":"CVE-2024-0204: Fortra GoAnywhere MFT Authentication Bypass Deep-Dive"},"content":{"rendered":"
\n
<\/span><\/div>\n<\/p><\/div>\n
\n

On January 22, 2024 Fortra posted a security advisory<\/a> for their GoAnywhere MFT product. This advisory details an authentication bypass vulnerability, CVE-2024-0204, that allows an unauthenticated attacker to create an administrative user for the application. Customers were made aware of the issue by an internal security advisory post and patch made available on December 4, 2023, in which researchers malcolm0x<\/a> and Islam Elrfai<\/a> were originally credited with the discovery. In 2023, file transfer applications were a top target<\/a> by threat actors. Our POC can be found here<\/a>.<\/p>\n

Finding The Differences<\/h3>\n

The advisory mentions that the endpoint \/InitialAccountSetup.xhtml<\/code> can be deleted and the service restarted to mitigate the issue. Looking through the application directories, we find that this endpoint is mapped to the  com.linoma.ga.ui.admin.users.InitialAccountSetupForm<\/code> class  by inspecting the file GoAnywhere\/adminroot\/WEB-INF\/forms-faces.xml<\/code>.<\/p>\n

\n<\/picture>\n<\/a><\/p>\n

Using advanced tooling, we find that the GoAnywhere\/lib\/gamft-7.4.0.jar<\/code> project defines that class.<\/p>\n

\n<\/picture>\n<\/a><\/p>\n

Comparing the jar\u2019s for gamft between 7.4.0 and 7.4.1 reveals that several additional checks were added to the initializer for the InitialAccountSetupForm class.<\/p>\n

\"InitialAccountSetupForm.java\"\n<\/picture>\n