cve/2023/CVE-2023-0669.md

### [CVE-2023-0669](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0669)
![](https://img.shields.io/static/v1?label=Product&message=Goanywhere%20MFT&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%3D%207.1.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-502%20Deserialization%20of%20Untrusted%20Data&color=brighgreen)

### Description

Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. This issue was patched in version 7.1.2.

### POC

#### Reference
- http://packetstormsecurity.com/files/171789/Goanywhere-Encryption-Helper-7.1.1-Remote-Code-Execution.html
- https://attackerkb.com/topics/mg883Nbeva/cve-2023-0669/rapid7-analysis
- https://frycos.github.io/vulns4free/2023/02/06/goanywhere-forgotten.html

#### Github
- https://github.com/0xf4n9x/CVE-2023-0669
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
- https://github.com/Avento/CVE-2023-0669
- https://github.com/CVEDB/PoC-List
- https://github.com/CVEDB/awesome-cve-repo
- https://github.com/CVEDB/top
- https://github.com/H4lo/awesome-IoT-security-article
- https://github.com/Loginsoft-Research/Linux-Exploit-Detection
- https://github.com/Ostorlab/KEV
- https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
- https://github.com/aneasystone/github-trending
- https://github.com/cataiovita/CVE-2023-0669
- https://github.com/cataliniovita/CVE-2023-0669
- https://github.com/hktalent/TOP
- https://github.com/k0mi-tg/CVE-POC
- https://github.com/manas3c/CVE-POC
- https://github.com/nomi-sec/PoC-in-GitHub
- https://github.com/tanjiti/sec_profile
- https://github.com/trhacknon/CVE-2023-0669
- https://github.com/trhacknon/CVE-2023-0669-bis
- https://github.com/yosef0x01/CVE-2023-0669-Analysis