SQL Injection in Accellion FTA document_root.html via Host header

Successful exploitation can lead to compromise of the Accellion FTA appliance, including execution of remote commands, deployment of a web shell, viewing and exfiltration of files stored or handled by the appliance, and subsequent extortion activity. The provided content also indicates attackers used the vulnerability as an initial access vector and potentially to pivot further into victim environments. In observed incidents, exploitation supported command execution, data theft, and log cleanup on compromised systems.

If immediate remediation is not possible, isolate or block internet access to and from systems hosting Accellion FTA, prioritize forensic collection, and investigate for indicators of compromise such as suspicious requests to /courier/document_root.html, evidence of Host-header SQL injection in rewrite.log, unexpected requests involving about.html/about.htmldwn, and presence of web shells at reported paths. Audit FTA accounts and passwords, reset exposed security tokens including the W1 encryption token, and monitor for suspicious outbound connections and data transfers. Given active exploitation and product end-of-life, mitigation should be treated only as a temporary measure pending upgrade or migration.

Upgrade Accellion FTA to a fixed release. The provided content states CVE-2021-27101 is fixed in FTA_9_12_380 and later, and later joint advisory guidance recommends updating FTA to FTA_9_12_432 or later. Because Accellion FTA reached end of life on April 30, 2021, organizations should migrate to a supported file-sharing platform, as recommended by Accellion and government advisories.