Fortra GoAnywhere Managed File Transfer (MFT) < 7.6.3 / 7.7.x < 7.8.4 Deserialization (CVE-2025-10035)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(265438);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/09/30");

  script_cve_id("CVE-2025-10035");
  script_xref(name:"IAVB", value:"2025-B-0161");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/10/20");

  script_name(english:"Fortra GoAnywhere Managed File Transfer (MFT) < 7.6.3 / 7.7.x < 7.8.4 Deserialization (CVE-2025-10035)");

  script_set_attribute(attribute:"synopsis", value:
"A web application running on the remote server is affected by a deserialization vulnerability.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the instance of Fortra GoAnywhere Managed File Transfer (MFT) running on the
remote web server is prior to 7.6.3 or 7.7.x prior to 7.8.4. It is, therefore, affected by a deserialization
vulnerability:

  - A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly
    forged license response signature to deserialize an arbitrary actor-controlled object, possibly leading to command
    injection. (CVE-2025-10035)
 
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.fortra.com/security/advisories/product-security/fi-2025-012
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?df0a32ce");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Fortra GoAnywhere Managed File Transfer (MFT) 7.6.3 or 7.8.4 or later.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-10035");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/09/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/09/18");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/09/19");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:helpsystems:goanywhere_managed_file_transfer");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:fortra:goanywhere_managed_file_transfer");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("fortra_goanywhere_mft_web_detect.nbin", "fortra_goanywhere_win_installed.nbin");
  script_require_keys("installed_sw/Fortra GoAnywhere MFT");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Fortra GoAnywhere MFT', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '7.6.3'},
        {'min_version':'7.7', 'fixed_version': '7.8.4'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);