Full Report
MFT and other trusted systems collect files, access and connections. Patching and inspecting what moves through it are separate defenses.
Analysis Summary
# Vulnerability: Critical Exploitation of MFT and Enterprise Integration Systems
## CVE Details
- **CVE ID:** CVE-2025-10035
- **CVSS Score:** 10.0 (Critical)
- **CWE:** Deserialization of Untrusted Data
- **CVE ID:** CVE-2025-61882
- **CVSS Score:** [Not explicitly listed, but described as Critical/RCE]
- **CWE:** Unauthenticated Remote Code Execution (RCE)
## Affected Systems
- **Products:**
- Fortra GoAnywhere MFT
- Oracle E-Business Suite (specifically BI Publisher Integration component)
- Cleo File-Transfer products
- **Versions:**
- GoAnywhere MFT: License Servlet component
- Oracle E-Business Suite: Environments utilizing BI Publisher
- **Configurations:** Systems exposed to the public internet or acting as central nodes for EDI pipelines and vendor portals.
## Vulnerability Description
The vulnerabilities involve two primary vectors:
1. **CVE-2025-10035:** A critical deserialization flaw in the Fortra GoAnywhere License Servlet. Deserialization vulnerabilities allow attackers to pass malicious objects into an application, leading to unauthorized code execution.
2. **CVE-2025-61882:** An unauthenticated RCE vulnerability in the Oracle BI Publisher Integration. This allows an external attacker to execute arbitrary commands on the host system without requiring valid login credentials.
## Exploitation
- **Status:** Exploited in the wild (Attributed to Storm-1175 and Cl0p-linked groups).
- **Complexity:** Low (Unauthenticated/Remote).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** Total (Extensive data exfiltration observed, e.g., MOVEit and Hertz breaches).
- **Integrity:** Total (Ability to execute remote code and deploy ransomware).
- **Availability:** Total (Deployment of Medusa ransomware and service disruption).
## Remediation
### Patches
- **Fortra GoAnywhere MFT:** Apply latest security updates addressing the License Servlet deserialization flaw.
- **Oracle E-Business Suite:** Apply the specific security advisory patches for the BI Publisher Integration (CVE-2025-61882).
- **Cleo:** Ensure all file-transfer products are updated to post-December 2024 versions.
### Workarounds
- **Network Segmentation:** Isolate MFT and EDI systems from the general corporate network.
- **Access Control:** Restrict access to management interfaces (like License Servlets) to trusted IP ranges only.
## Detection
- **Indicators of Compromise:**
- Presence of Storm-1175 or Medusa ransomware TTPs (Tactics, Techniques, and Procedures).
- Unexpected outbound traffic from MFT queues.
- Unusual activity within the BI Publisher Integration logs.
- **Detection Methods and Tools:**
- **Upstream Payload Inspection:** Implement tools to scan files in the "landing zone" or MFT queue before they reach the endpoint.
- **EDR/XDR:** Monitor for execution-time anomalies, though the article warns EDR may miss files sitting idle in transfer queues.
## References
- **Vendor Advisories:**
- Oracle Advisory (CVE-2025-61882)
- Fortra Security Bulletins
- **Relevant links:**
- hxxps[://]www[.]reversinglabs[.]com/blog/the-next-moveit-may-already-be-in-your-file-transfer-queue
- hxxps[://]www[.]reversinglabs[.]com/clickfix