SSRF in Accellion FTA wmProgressstat.html

Successful exploitation can allow an attacker to coerce the vulnerable FTA appliance into making unintended server-side requests. In the broader Accellion FTA intrusion chains observed in the wild, exploitation of this vulnerability contributed to compromise of FTA systems, deployment of webshell capability, data theft, and subsequent extortion activity. On its own, the vulnerability exposes the appliance to unauthorized internal or backend request abuse and can facilitate further compromise when chained with other flaws.

If immediate patching is not possible, restrict or isolate internet exposure of Accellion FTA systems, especially public access to the vulnerable appliance. Monitor for suspicious POST requests to the affected endpoint and investigate signs of exploitation or chained compromise. Because this vulnerability was exploited alongside other Accellion FTA flaws, mitigation should include containment of the appliance, review for unauthorized server-side requests and webshell activity, credential and token resets, and accelerated migration to a supported file-transfer platform.

Upgrade Accellion FTA to a fixed release. The provided vulnerability description identifies FTA_9_12_416 and later as fixed for CVE-2021-27103. Broader vendor and government guidance for the Accellion FTA incident also directed organizations to update to later supported FTA builds and to migrate away from FTA because the product reached end of life. If compromise is suspected, perform incident response actions including forensic acquisition, credential resets, token rotation, and review for follow-on attacker activity.