CVE-2024-0204

Authentication Bypass in GoAnywhere MFT

Description

Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.

Solution:

Upgrade to version 7.4.1 or higher. The vulnerability may also be eliminated in non-container deployments by deleting the InitialAccountSetup.xhtml file in the install directory and restarting the services. For container-deployed instances, replace the file with an empty file and restart. For additional information, see https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml (registration required). https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml

Workaround:

Users are encouraged to apply defense-in-depth tactics to limit access to the administrative console. Do not expose the console to the internet and apply web application controls such as a WAF, monitoring, and access controls.

Link	Tags
https://www.fortra.com/security/advisory/fi-2024-001	vendor advisory
https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml	permissions required
http://packetstormsecurity.com/files/176683/GoAnywhere-MFT-Authentication-Bypass.html	third party advisory vdb entry
http://packetstormsecurity.com/files/176974/Fortra-GoAnywhere-MFT-Unauthenticated-Remote-Code-Execution.html

What is the severity of CVE-2024-0204?: CVE-2024-0204 has been scored as a critical severity vulnerability.
How to fix CVE-2024-0204?: To fix CVE-2024-0204: Upgrade to version 7.4.1 or higher. The vulnerability may also be eliminated in non-container deployments by deleting the InitialAccountSetup.xhtml file in the install directory and restarting the services. For container-deployed instances, replace the file with an empty file and restart. For additional information, see https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml (registration required). https://my.goanywhere.com/webclient/ViewSecurityAdvisories.xhtml
Is CVE-2024-0204 being actively exploited in the wild?: It is possible that CVE-2024-0204 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~93% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-0204?: CVE-2024-0204 affects Fortra GoAnywhere MFT.