GoAnywhere MFT is a tool that helps businesses send and receive files securely, designed to protect data during transfers, automate file-sharing tasks, and work with both cloud and on-prem systems.A critical-severity vulnerability was recently discovered in Fortra’s GoAnywhere MFT, with users urged to apply the fix as soon as possible.In early 2023, the Cl0p ransomware group found a zero-day in the tool, and used it to attack more than 130 companies, including big names like Procter & Gamble and Hitachi Energy. Although Fortra quickly released a patch, many companies didn’t update in time, which allowed Cl0p to steal sensitive data such as personal and business information, and then use it to extort the victims for money. This time around, there is no word of in-the-wild abuse, but Fortra did say that it discovered the bug “during a security check”. The flaw is described as a deserialization vulnerability in the License Servlet of Fortra’s GoAnywhere MFT, allowing threat actors with a validly forged license response signature to deserialize an arbitrary actor-controlled object. What is your take on GoAnywhere MFT security ?
