Fortra GoAnywhere Managed File Transfer (MFT) < 7.10.0 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(321346);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/18");

  script_cve_id(
    "CVE-2025-1241",
    "CVE-2025-14362",
    "CVE-2026-0971",
    "CVE-2026-0972",
    "CVE-2026-1089"
  );

  script_name(english:"Fortra GoAnywhere Managed File Transfer (MFT) < 7.10.0 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"A web application running on the remote server is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the instance of Fortra GoAnywhere Managed File Transfer (MFT) running on the
remote host is prior to 7.10.0. It is, therefore, affected by multiple vulnerabilities, including:

  - The login limit is not enforced on the SFTP service if the Web User is configured to log in with an SSH Key,
    making the SSH key vulnerable to being guessed via brute force. (CVE-2026-0972, CVE-2025-14362)

  - A user-controlled HTTP header allows attackers to trigger a DNS lookup, as well as DNS rebinding and information
    disclosure. (CVE-2026-1089)

  - Encrypted values utilize a static IV which allows admin users to brute-force decryption of data. (CVE-2025-1241)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://www.fortra.com/security/advisories/product-security/fi-2026-005
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b422313d");
  # https://www.fortra.com/security/advisories/product-security/fi-2026-003
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a197a444");
  # https://www.fortra.com/security/advisories/product-security/fi-2026-002
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?937365f8");
  # https://fortra.com/security/advisories/product-security/FI-2026-001
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9341125a");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Fortra GoAnywhere Managed File Transfer (MFT) 7.10.0 or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-14362");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-1241");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/21");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/21");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/17");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:helpsystems:goanywhere_managed_file_transfer");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:fortra:goanywhere_managed_file_transfer");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("fortra_goanywhere_mft_web_detect.nbin", "fortra_goanywhere_win_installed.nbin");
  script_require_keys("installed_sw/Fortra GoAnywhere MFT");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Fortra GoAnywhere MFT', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '7.10.0'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);