Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is This Bad? This Feels Bad. (Fortra GoAnywhere CVE-2025-10035)

labs.watchtowr.com

Post reply on HN
Print view View original

1–10 of 17 posts

Re: Is This Bad? This Feels Bad. (Fortra GoAnywhere CVE-2025-10035)

#3

Post by lyu07282 »

> We can’t see a path to exploit this without a valid private key. On paper, that should kill the bug dead.

The juicy theory bit:

    The vendor accidentally signed evil. Imagine this:
    When you activate your GoAnywhere product, your installation generates a serialized license request.
    It’s sent to the vendor’s license server (my.goanywhere.com)
    If someone slipped a malicious object inside that request and the vendor blindly signed it, attackers would now have a perfectly valid signed payload that works everywhere.
That would be wild if true. Basically this is a object serialization vulnerability exploited in the wild right now, but it only deserializes signed objects, so the author is speculating if their private key leaked, or even better, if the company signed the malicous payload themselves lol

Re: Is This Bad? This Feels Bad. (Fortra GoAnywhere CVE-2025-10035)

#5

Post by deskamess »

lyu07282 wrote: post #3

> We can’t see a path to exploit this without a valid private key. On paper, that should kill the bug dead. The juicy theory bit: The vendor accidentally signed evil. Imagine this: When you activate your GoAnywhere product, your installation generates a serialized license request. It’s sent to the vendor’s license server (my.goanywhere.com) If someone slipped a malicious object inside that request and the vendor blin…

So would the signed 'object' contain code? Or is it just data? And even if it is code, does deserializing mean execution? I guess it could mean execution at some other stage in the process.

What is the end-goal of this... would it be data exfiltration vs ransomware.

Re: Is This Bad? This Feels Bad. (Fortra GoAnywhere CVE-2025-10035)

#6

Post by lyu07282 »

deskamess wrote: post #5
lyu07282 wrote: post #3

> We can’t see a path to exploit this without a valid private key. On paper, that should kill the bug dead. The juicy theory bit: The vendor accidentally signed evil. Imagine this: When you activate your GoAnywhere product, your installation generates a serialized license request. It’s sent to the vendor’s license server (my.goanywhere.com) If someone slipped a malicious object inside that request and the vendor blin…

So would the signed 'object' contain code? Or is it just data? And even if it is code, does deserializing mean execution? I guess it could mean execution at some other stage in the process. What is the end-goal of this... would it be data exfiltration vs ransomware.

It often results in remote code/command execution, its data that de-serializes into java objects. But during the instantiation or sometimes deconstruction of objects, code can be executed. Popular tool for java: https://github.com/frohoff/ysoserial

Re: Is This Bad? This Feels Bad. (Fortra GoAnywhere CVE-2025-10035)

#8

Post by cwsx »

deskamess wrote: post #5
lyu07282 wrote: post #3

> We can’t see a path to exploit this without a valid private key. On paper, that should kill the bug dead. The juicy theory bit: The vendor accidentally signed evil. Imagine this: When you activate your GoAnywhere product, your installation generates a serialized license request. It’s sent to the vendor’s license server (my.goanywhere.com) If someone slipped a malicious object inside that request and the vendor blin…

So would the signed 'object' contain code? Or is it just data? And even if it is code, does deserializing mean execution? I guess it could mean execution at some other stage in the process. What is the end-goal of this... would it be data exfiltration vs ransomware.

> What is the end-goal of this... would it be data exfiltration vs ransomware.

The end-goal is to gain complete access to the system - the outcome (data theft or ransomware) is customers choice

Re: Is This Bad? This Feels Bad. (Fortra GoAnywhere CVE-2025-10035)

#9

Post by cogman10 »

Ah, my most hated enemy. Java Serialization.

I know that some JDK devs will argue that it's one thing that made Java popular. And I'm sure they are right. But man oh man if it's not one of the biggest footguns in the current JDK. It also constantly gets in the way of Java language development. They had to figure out, for example, "How do I serialize a lambda"? Which should really tell you just how ridiculous this thing is.

If there's one breaking change to the JDK that I'd welcome, it's the removal of Java serialization. But that will never happen because WAY too many companies depend on it.

Post reply on HN