Accellion FTA SQL Injection via Host Header
Actively exploited in the wild. Patch or mitigate immediately — don't wait for a maintenance window.
An unauthenticated attacker, remotely over the network, with no user interaction, can fully compromise the system — steal data, tamper with it and take it offline.
Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.
Techniques marked “observed” are corroborated by threat intelligence; the rest are inferred from the weakness type (CWE) and attack vector.
Corroborated threat activity referencing this CVE — with source and confidence, not inference.
These techniques were analysed against this CVE's real-world exploitation — the matching entries in the ATT&CK chain above are marked “observed”.
Generated by Wavense from the CVE record — an immediate mitigation and the permanent fix.
As an interim measure, deploy a Web Application Firewall (WAF) in front of the Accellion FTA instance to filter and block requests with suspicious or malformed Host headers and known SQL injection patterns. Additionally, restrict network access to the Accellion FTA server to only necessary internal IP ranges and enhance logging for database errors or unusual activity.
The permanent resolution is to upgrade your Accellion FTA appliance to version 9_12_380 or later immediately. These fixed versions contain the necessary security patches to remediate the SQL injection vulnerability, eliminating the risk associated with crafted Host headers.
An attacker can exploit this SQL injection vulnerability by crafting a malicious Host header, potentially gaining unauthorized access to the underlying database. This could lead to sensitive data exfiltration, database manipulation, or, in severe cases, remote code execution, severely compromising the system and sensitive information.
No CWE classification has been assigned.
Other CVEs affecting fta
Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.