HTTP Header Injection in Fortra GoAnywhere MFT Enables DNS Lookups and Information Disclosure

User‑Controlled HTTP Header in Fortra's GoAnywhere MFT prior to version 7.10.0 allows attackers to trigger a DNS lookup, as well as DNS Rebinding and Information Disclosure.

• Fortra GoAnywhere MFT: versions with version starting at 0 and less than 7.10.0 are marked affected using semver.
• The record sets the product's default status outside the stated range to unaffected.
• Fortra identifies 7.10.0 as the remediated release and advises upgrading to 7.10.0 or later. The record does not enumerate later or parallel release branches separately.

Fortra GoAnywhere MFT processes a user-controlled HTTP header in a way that allows attacker-supplied input to affect a downstream component and trigger a DNS lookup. The weakness is classified as CWE-74, improper neutralization of special elements in output used by a downstream component. The supplied data indicates that exploitation is network reachable and does not require authentication or user interaction. The description also identifies DNS rebinding and information disclosure, but it does not identify the header name, endpoint, downstream component, disclosed data, or the precise conditions under which rebinding affects another resource. The available record therefore does not establish that the flaw provides access to a particular internal service or permits data modification.

The flaw can be triggered remotely through a network request containing an HTTP header controlled by the attacker. The supplied vector indicates that no privileges, authentication, or user interaction are required, and that exploitation complexity is low. The supplied record sets public_exploit to false; the CISA enrichment attached to the record marks exploitation as none and automation as yes. These statuses do not prove that an exploit cannot be developed later. The public record does not provide a payload, header name, endpoint, or specific exploitation sequence.

Successful exploitation may cause GoAnywhere MFT to perform attacker-directed DNS lookups, support DNS rebinding behavior, and disclose information. The supplied record indicates limited confidentiality impact, no integrity impact, and unchanged scope. Because exploitation requires neither privileges nor user interaction, instances with network-reachable endpoints should receive priority for remediation. The available evidence does not establish the disclosed data, destination resources, ability to cross a trust boundary, or the service impact in a particular deployment.

An attacker may cause a GoAnywhere MFT server to perform unexpected DNS lookups, creating additional traffic and dependencies on the organization's name-resolution infrastructure. DNS rebinding may increase risk where trust decisions rely on hostnames, but the available record does not confirm a specific path to an internal resource. The flaw may also expose a limited amount of information; the type and scope of that information are not documented. The supplied vector indicates no integrity impact and only limited effects on confidentiality and availability.

1. Upgrade first: upgrade Fortra GoAnywhere MFT to the remediated version 7.10.0 or later, following Fortra's guidance.
2. Recheck every instance, node, and standby environment to ensure that no deployment remains on a version below 7.10.0.
3. Verify the installed version after the change and confirm that GoAnywhere MFT components have started with the remediated release.
4. The reviewed record and advisory do not specify a temporary workaround or configuration change. If an upgrade cannot be completed immediately, treat instances in the affected branch as unremediated and handle their exposure through the organization's change and containment process, but do not treat that process as a substitute for the vendor fix.

1. Inventory all systems running GoAnywhere MFT and compare installed versions with the affected boundary in affected_summary.
2. Identify instances whose HTTP endpoints are reachable from untrusted networks, because the supplied vector permits network exploitation without authentication.
3. Review HTTP reverse-proxy, web-server, and application logs for unusual request headers, and correlate them with DNS resolver logs for unexpected lookups originating from GoAnywhere MFT hosts. This is precautionary monitoring, not a vendor-published IOC.
4. If suspicious requests or unexpected DNS lookups are found, investigate possible links to DNS rebinding and information disclosure. The absence of suitable log evidence does not prove that a system is safe or was not exploited.