Fortra GoAnywhere MFT Unauthenticated Remote Code Execution

This Metasploit module exploits a vulnerability in Fortra GoAnywhere MFT that allows an unauthenticated attacker to create a new administrator account. This can be leveraged to upload a JSP payload and achieve RCE. GoAnywhere MFT versions 6.x from 6.0.1, and 7.x before 7.4.1 are vulnerable.

account administrator attacker can code code execution exploits fortra fortra goanywhere fortra goanywhere mft goanywhere goanywhere mft jsp metasploit mft payload rce remote code remote code execution unauthenticated upload vulnerability vulnerable