Path Traversal in GoAnywhere MFT 7.4.1 and Earlier

A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients.

Using a crafted URL, an unauthorized user may access pages within GoAnywhere. This may lead to information disclosure. In non-default configurations it may also allow web user self-registration in some circumstances.

To mitigate against unintended user registration, ensure Web User Self-Registration is disabled and there are no self-registration rules configured with ‘allow’ permissions.

For customers who have self-registration enabled, this is not an authentication bypass issue. However, these customers are encouraged to review the registration rules they have configured and limit the scope of their configured rule patterns. Customers are encouraged to configure their rules to require admin approval and deny all other email patterns that do not match an email pattern required by their organization.