GoAnywhere MFT Remote Code Execution (CVE-2023-0669): Zero-Day Deserialization

1. February 2023: The Cl0p MFT Campaign Begins

In February 2023, four months prior to the MOVEit Transfer incident, the Cl0p ransomware syndicate launched a devastating mass-exploitation campaign targeting another leading Managed File Transfer (MFT) solution: Fortra GoAnywhere MFT. The vulnerability, cataloged as CVE-2023-0669, allowed remote attackers with network access to the administrative web interface to execute arbitrary code without prior authentication.

Over 130 major organizations (including Community Health Systems, Hitachi Energy, and Procter & Gamble) had sensitive corporate documents and patient records exfiltrated within a two-week exploitation window.

2. CVE Metadata Overview

3. Technical Root Cause: Hardcoded Cryptographic Keys & Deserialization

GoAnywhere MFT included a servlet endpoint at /goanywhere/lic/accept designed to process automated license registration responses from Fortra servers.

The endpoint accepted a parameter named bundle containing an encrypted, base64-encoded string. To process the bundle, the application:

1. Decrypted the bundle using a hardcoded, static AES initialization vector and cryptographic key embedded directly in the application source code: $2a$10$0....
2. Passed the decrypted byte stream directly into a standard Java ObjectInputStream.readObject() deserialization method without class filtering or type validation.

An attacker simply generated a Java deserialization gadget payload (using Commons Collections or Spring gadgets) using tools like ysoserial, encrypted the payload using Fortra's extracted hardcoded AES key, and submitted it via an HTTP POST request to achieve instant code execution as the local service account:

POST /goanywhere/lic/accept HTTP/1.1
Host: mft.enterprise.com:8000
Content-Type: application/x-www-form-urlencoded

bundle=u2K8s9x... [Encrypted Ysoserial CommonsCollections Payload]

4. Detection and Remediation Protocol

# Search GoAnywhere access logs for calls to the licensing endpoint
grep "/goanywhere/lic/accept" /opt/HelpSystems/GoAnywhere/userdata/logs/catalina.out

5. Mandatory Hardening Blueprint

1. Upgrade GoAnywhere MFT to version 7.1.2 or later immediately.
2. Disable the public licensing portal endpoint or isolate administrative port 8000 / 8001 strictly behind internal enterprise subnets.
3. Audit all file transfer logs and rotate connected cloud storage credentials (AWS S3, Azure Blob, SFTP keys).