‘An attacker's playground:’ Crims exploit GoAnywhere perfect-10 bug

Security researchers have confirmed that threat actors have exploited the maximum-severity vulnerability affecting Fortra's GoAnywhere managed file transfer (MFT), and chastised the vendor for a lack of transparency. The experts over at watchTowr, never ones to mince their words, described the revelation as "an increasingly …

[Taliesinawen]

Secure file transfers using browser-based admin interface :o

Browser-based admin interface with customizable dashboards and drag-and-drop tools. A deserialization flaw in the License Servlet component of GoAnywhere MFT, which allows remote unauthenticated attackers to execute arbitrary code on the server.

Java developer: Lets create a serialization/deserialization interface.

Java Intern: What about security?

Java developer: We'll assume the downstream developer will take care of that.

Developer: Lets create a serialization/deserialization Java servlet.

Intern: What about security?

Developer: We'll assume the Java Serializable class will take care of that.

[sitta_europea]

Re: Secure file transfers using browser-based admin interface :o

"Secure [something] using browser ..."

It's bad enough if the Internet is involved at all, but I can't believe that in 2025 anybody is still claiming that anything which allows a browser anywhere near it can be secure.

[Claptrap314]

How does ANY company with >500 employees use this garbage?

SSHD comes with sftp built in. I would use an intern to build out a control interface allowing our sales team & whatnot to create short-term accounts on the server. (Of course, I would examine their work carefully.)

But NO! We have to have these "solutions" with more bugs than a two-week old corpse.