Is GoAnywhere MFT or any components of the software susceptible to the recent OpenPGP & S/MIME vulnerabilities?
In light of the recent OpenPGP & S/MIME warning (EFAIL), HelpSystems has performed a software security review of GoAnywhere Managed File Transfer (GoAnywhere) to ensure our customers are not affected by this vulnerability. The review has yielded positive results and demonstrates that GoAnywhere is already protected from EFAIL.
The EFAIL warning identifies a weakness with encrypted emails, and how secure content can be exfiltrated. The weakness can be further exploited by using the CBC/CFB gadget attack on OpenPGP encrypted MIME parts. An attacker may intercept and alter an encrypted email and add specially crafted HTML MIME parts which will cause vulnerable email clients to send decrypted data to an external party.
While GoAnywhere can process OpenPGP encrypted files, it does not support OpenPGP encrypted emails. GoAnywhere is not affected by the CBC/CFB gadget attack on OpenPGP and S/MIME. GoAnywhere uses standard SSL/TLS to decrypt email messages. When messages are retrieved from a mail server, GoAnywhere maintains a separation between MIME parts, writing each part to their own unique file. Additionally, GoAnywhere does not evaluate or render HTML emails; thus, mitigating the risk of a direct exfiltration attack.
The GoAnywhere team is dedicated to the continued stability and security of its products. Security reviews will be performed as new information is published.