Article
MOVEit Transfer Software Exploited Through Critical Zero Day Vulnerability 2023
MOVEit Transfer zero day CVE-2023-34362 is a critical SQL injection flaw (CVSS 9.8) exploited from May 2023. See the facts, CISA attribution, what to…
Read more
Exploited vulnerability
GoAnywhere MFT remote code execution (CVE-2023-0669)
A flaw in GoAnywhere MFT, a managed file transfer product from Fortra.
- On CISA KEV
- CVE ID
- CVE-2023-0669
- CISA KEV
- Listed
- Affected product
- GoAnywhere MFT
- Exploited
- Yes
- Published
- February 2023
In short
CVE-2023-0669 is a flaw in GoAnywhere MFT, a managed file transfer product from Fortra. It lets an outsider run commands on the server without logging in. CISA and the FBI say the Cl0p ransomware group used it as a zero-day.
- CVECVE-2023-0669
- ProductFortra (formerly HelpSystems) GoAnywhere MFT
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps4actions listedUpdate to a fixed version · Limit remote access tools
What it allows
An attacker who can reach the vulnerable component can run commands on the file transfer server with no login. File transfer servers hold business data, so the main risk is theft of stored files. In the campaign CISA and the FBI describe, the group stole data from the GoAnywhere platform itself.
Who is affected
NVD says the issue was patched in version 7.1.2, so earlier versions are affected. Fortra's own advisory could not be opened for this page, so check the vendor's customer notice for the full list of affected builds and fixes.
NVD published the record in February 2023 and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 10 February 2023. The KEV entry flags known use in ransomware campaigns.
In advisory AA23-158A (7 June 2023), CISA and the FBI say the Cl0p ransomware group launched a campaign using a zero-day, now cataloged as CVE-2023-0669, against the GoAnywhere MFT platform. The group claimed it took data affecting approximately 130 victims over 10 days. The advisory says movement into victim networks from the platform was not identified, which suggests the breach stayed on the platform. Ransom notes followed over the next several weeks as the group parsed the stolen data.
Timeline
- 6 February 2023
NVD record published. NVD publishes CVE-2023-0669; it says the issue was patched in version 7.1.2.
- 10 February 2023
Added to CISA KEV. CISA adds the flaw to the KEV catalog; the entry flags known ransomware use.
- 7 June 2023
CISA and FBI advisory AA23-158A. The advisory says the Cl0p group used this zero-day against GoAnywhere MFT and claimed data from approximately 130 victims over 10 days.
Who exploits it
- Ransomware group Cl0p Cl0p is a ransomware operation first seen in February 2019 and, per a joint FBI and CISA advisory (AA23-158A, June 2023), also known as TA505. Active · Since 2019 · Ransomware as a service, and data theft campaigns (per the advisory)
- Ransomware group LockBit LockBit is a ransomware as a service operation first seen in January 2020. Disrupted · Since 2020 · Ransomware as a service
What to do
-
Update to a fixed version
NVD says version 7.1.2 patched the flaw. Use the vendor's customer notice to pick the current fixed release.
-
Limit remote access tools
CISA and the FBI recommend blocking inbound and outbound connections on common remote access software ports and protocols at the network perimeter.
-
Control what can run
The advisory recommends application controls that manage software execution, including allowlisting remote access programs.
-
Review what the platform stored
The advisory says the data was taken from the file transfer platform itself. Work out which files were held on the server and whether they were exposed.
Questions
What is CVE-2023-0669?
CVE-2023-0669 is a pre-authentication command injection flaw in GoAnywhere MFT, a managed file transfer product from Fortra. An outsider who can reach the vulnerable component can run commands without logging in.
Who exploited the GoAnywhere MFT flaw?
In advisory AA23-158A, CISA and the FBI say the Cl0p ransomware group used it as a zero-day against the GoAnywhere MFT platform. The group claimed it took data affecting approximately 130 victims over 10 days.
Which GoAnywhere MFT versions are affected?
NVD says the issue was patched in version 7.1.2, so earlier versions are affected. Check the vendor's customer notice for the full list of affected builds and fixes.
Is CVE-2023-0669 on the CISA KEV list?
Yes. CISA added CVE-2023-0669 to the Known Exploited Vulnerabilities catalog on 10 February 2023, and the entry flags known use in ransomware campaigns. CISA and the FBI tie it to Cl0p in advisory AA23-158A.
In our research
Sources
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 53 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 28 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 60 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 42 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 151 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 109 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.