CISA Warns of Active Exploitation of Accellion File Transfer Appliance Vulnerabilities
The Cybersecurity and Infrastructure Security Agency (CISA) and cybersecurity authorities in Australia, New Zealand, Singapore, and the United Kingdom have issued an alert for users of the Accellion File Transfer Appliance (FTA) about 4 vulnerabilities that are being actively exploited by a threat actor to gain access to sensitive data.
The Accellion FTA is a legacy file transfer appliance used to share large files. Accellion identified a zero-day vulnerability in the product in mid-December and released a patch to address the flaw, although further vulnerabilities have since been identified.
The vulnerabilities are tracked as:
- CVE-2021-27101 – SQL injection vulnerability via a crafted HOST header
- CVE-2021-27102 – Operating system command execution vulnerability via a local web service
- CVE-2021-27103 – Server-side request forgery via a crafted POST request
- CVE-2021-27104 – Operating system command execution vulnerability via a crafted POST request
The SQL injection flaw (CVE-2021-27011) allows unauthorized individuals to run remote commands on targeted devices. An exploit for the vulnerability has been combined with a webshell, with the latter used to receive commands sent by the attacker and exfiltrate data and clean up logs. The removal of clean-up logs allows the attacker to avoid detection and hampers analysis of the attack.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Once sensitive data have been exfiltrated, the attacker attempts to extort money from the victim. Threats are issued to publicly expose the stolen data on a ransomware data leak site if the ransom is not paid. FireEye/Mandiant have linked the attacks with the FIN11 and CL0P ransomware operation, although ransomware is not being used in the attacks.
Accellion became aware of attacks exploiting the vulnerabilities in January 2021 and reports fewer than 100 clients have been affected and around 2 dozen clients are believed to have suffered significant data theft. Kroger has recently reported that some pharmacy and Little clinic customers have been affected, and Centene has similarly suffered a data breach via the exploitation of the vulnerabilities. Other victims include Transport for New South Wales in Australia, the Canadian Aircraft manufacturer Bombardier, the Reserve Bank of New Zealand, the Australian financial regulator ASIC, the Office of the Washington State Auditor, and the University of Colorado.
CISA has provided Indicators of Compromise (IoCs) in its cybersecurity alert (AA21-055A) which can be used by Accellion customers to determine if the vulnerabilities have been exploited, along with advice should the malicious activity be detected.
In addition to performing an analysis to identify if the flaws have been exploited, CISA recommends isolating systems hosting the software from the Internet and updating Accellion FTA to version FTA_9_12_432 or later. It is also recommended by Accellion and CISA to migrate from this legacy product to a supported file-sharing platform. The Accellion FTA reaches end-of-life on April 30, 2021. Accellion recommends upgrading to its Kiteworks file-sharing platform, which has enhanced security features.
