Description
Fortra GoAnywhere MFT是美国Fortra公司的一种安全的文件传输解决方案。 Fortra GoAnywhere MFT 7.4.1之前版本存在安全漏洞。攻击者利用该漏洞绕过身份验证，从而通过管理门户创建管理员用户。
GoAnywhere MFT InitialAccountSetup.xhtml 权限绕过漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.fortra.com/security/advisories/product-security/fi-2024-001
https://www.rapid7.com/blog/post/2024/01/23/etr-cve-2024-0204-critical-authentication-bypass-in-fortra-goanywhere-mft/
https://horizon3.ai/attack-research/attack-blogs/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/
https://www.secrss.com/articles/63199
https://cloud.tencent.com/developer/article/2385578
https://www.venustech.com.cn/new_type/aqtg/20240129/26954.html
https://zhi.oscs1024.com/40891.html
https://cn-sec.com/archives/2426832.html
https://www.kroll.com/en/publications/cyber/authentication-bypass-in-fortra-goanywhere-mft
https://github.com/horizon3ai/CVE-2024-0204
https://www.exploit-db.com/exploits/52308
https://nvd.nist.gov/vuln/detail/CVE-2024-0204