Fortra GoAnywhere MFT CVE-2023-0669 (pre-authentication deserialization command injection in the License Response Servlet, exploited by the Cl0p group, CISA KEV): which version fixes it and what if the admin console was exposed?

What it is: CVE-2023-0669 is a pre-authentication flaw in Fortra (formerly HelpSystems) GoAnywhere Managed File Transfer where the license response handling deserializes attacker-controlled data, which allows command execution on the server. Fortra disclosed it as a zero-day in early February 2023 and the Cl0p ransomware group used it to steal data from many organizations. It is in the CISA KEV catalog (added 2023-02-10) with known ransomware use. Am I affected: - Self-hosted GoAnywhere MFT before 7.1.2. The risk was highest where the administrative console was reachable from the internet. - Find the version on the admin console or the product's About information. Fix: 1. Upgrade GoAnywhere MFT to 7.1.2 or later, and in practice to the latest supported release, since later versions fixed further issues. 2. Do not expose the administration console to the internet; restrict it to a management network or VPN. Fortra's initial guidance was also this kind of access restriction plus a configuration workaround, which applies only until you upgrade. 3. If the console was exposed while vulnerable, assume compromise and hunt: look for unexpected admin accounts, particularly ones created around the exploitation window, unfamiliar scheduled jobs or resources, and unusual files or processes on the server and in file-transfer logs. Rebuild from clean media, restore from a known-good backup, and rotate everything GoAnywhere stores or uses (service accounts, SFTP keys, database and trading-partner credentials). Treat files held in the product as possibly stolen and follow your breach-notification duties. Verify: the version shows 7.1.2 or later and the admin console is not reachable from the internet. Sources: https://nvd.nist.gov/vuln/detail/CVE-2023-0669 https://www.cisa.gov/known-exploited-vulnerabilities-catalog