# Fortra GoAnywhere MFT License Response Servlet 命令注入漏洞
## 漏洞概述
Fortra（前身为 HelpSystems）的 GoAnywhere MFT 存在一个预身份验证命令注入漏洞，该漏洞源于 License Response Servlet 对任意由攻击者控制的对象进行反序列化。
## 影响版本
此漏洞在版本 7.1.2 中得到修复，因此，所有低于 7.1.2 的版本均受影响。
## 漏洞细节
攻击者可以通过控制对象进行反序列化，从而在受影响的系统中执行任意命令。
## 影响
此漏洞允许未经身份验证的攻击者通过构造特定的请求来执行命令，可能造成系统被恶意控制或数据泄露等严重后果。
是否为 Web 类漏洞： 是
判断理由：
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | CVE-2023-0669 GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. | https://github.com/0xf4n9x/CVE-2023-0669 | POC详情 |
| 2 | CVE-2023-0669 GoAnywhere MFT command injection vulnerability | https://github.com/cataliniovita/CVE-2023-0669 | POC详情 |
| 3 | None | https://github.com/Griffin-01/CVE-2023-0669 | POC详情 |
| 4 | CVE analysis for CVE-2023-0669 | https://github.com/yosef0x01/CVE-2023-0669-Analysis | POC详情 |
| 5 | GoAnywhere MFT CVE-2023-0669 LicenseResponseServlet Deserialization Vulnerabilities Python RCE PoC(Proof of Concept) | https://github.com/Avento/CVE-2023-0669 | POC详情 |
| 6 | Fortra GoAnywhere MFT is susceptible to remote code execution via unsafe deserialization of an arbitrary attacker-controlled object. This stems from a pre-authentication command injection vulnerability in the License Response Servlet. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-0669.yaml | POC详情 |
| 7 | None | https://github.com/zakaria-laouani/cve-2023-0669-simulation | POC详情 |
暂无评论