Fortra GoAnywhere MFT User-Controlled HTTP Header Vulnerability Allowing DNS Lookup, DNS Rebinding, and Information Disclosure

A vulnerability in Fortra's GoAnywhere MFT, prior to version 7.10.0, allows attackers to manipulate HTTP headers to initiate a DNS lookup. This issue also facilitates DNS rebinding attacks and could lead to unauthorized information disclosure.

Impact

Exploitation of this vulnerability could result in DNS lookups being triggered by the application, potentially allowing for DNS rebinding attacks, which could be used to bypass the same-origin policy in web browsers. Additionally, the vulnerability could lead to unauthorized information disclosure.

Remediation

Users are advised to update to Fortra GoAnywhere MFT version 7.10.0 or later.