CVE-2021-27103
📋 TL;DR
This CVE describes a Server-Side Request Forgery (SSRF) vulnerability in Accellion File Transfer Appliance (FTA) versions 9_12_411 and earlier. Attackers can send crafted POST requests to wmProgressstat.html to make the server perform unauthorized requests to internal or external systems. Organizations using vulnerable Accellion FTA versions are affected.
💻 Affected Systems
- Accellion File Transfer Appliance (FTA)
📦 What is this software?
Fta by Accellion
⚠️ Risk & Real-World Impact
Worst Case
Attackers could pivot to internal networks, access sensitive internal services, exfiltrate data, or chain with other vulnerabilities for complete system compromise.
Likely Case
Unauthorized access to internal services, data exfiltration, or using the vulnerable server as a proxy for attacks against other systems.
If Mitigated
Limited impact with proper network segmentation, but still potential for information disclosure about internal network structure.
🎯 Exploit Status
Exploitation requires only a crafted HTTP POST request. This vulnerability was part of the Accellion FTA attacks in early 2021.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: FTA_9_12_416 and later
Vendor Advisory: https://www.accellion.com/products/fta/
Restart Required: Yes
Instructions:
1. Download FTA_9_12_416 or later from Accellion support portal. 2. Backup current configuration. 3. Apply the update following Accellion's upgrade documentation. 4. Restart the FTA appliance. 5. Verify the update was successful.
🔧 Temporary Workarounds
Block wmProgressstat.html Access
linuxTemporarily block access to the vulnerable endpoint via web application firewall or network controls
iptables -A INPUT -p tcp --dport 443 -m string --string "wmProgressstat.html" --algo bm -j DROP
Network Segmentation
allRestrict outbound network access from the FTA appliance to only necessary services
🧯 If You Can't Patch
- Isolate the FTA appliance in a DMZ with strict outbound firewall rules
- Implement web application firewall rules to detect and block SSRF attempts
🔍 How to Verify
Check if Vulnerable:
Check the FTA version via the web interface or SSH: version should be 9_12_411 or earlierCheck Version:
ssh admin@fta-host "cat /usr/local/accellion/fta/version.txt"Verify Fix Applied:
Verify version is FTA_9_12_416 or later and test that POST requests to wmProgressstat.html no longer process external URLs📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to wmProgressstat.html
- Outbound connections from FTA to unexpected internal/external IPs
Network Indicators:
- HTTP POST requests to /wmProgressstat.html with URL parameters
- Outbound connections from FTA to internal services it shouldn't access
SIEM Query:
source="fta_logs" AND uri="/wmProgressstat.html" AND method="POST"