CVE-2021-27104

This vulnerability lets an attacker send a disguised web request to Accellion FTA’s admin areas and make the server run operating-system commands. Think of it like someone finding a “back door” into your building’s security office where they can order the building’s systems to do whatever they want. Because it works without a login, it’s especially dangerous if the system can be reached from the internet.

This matters if you run Accellion FTA versions up to and including 9_12_370. You’re at risk when the server is reachable over the network and the vulnerable version is running, because no login is required to attempt the attack. The findings don’t confirm whether it’s reachable in a default setup, so your exposure depends on whether your Accellion FTA admin endpoints are network-accessible from where attackers can reach them.

This is RED because CISA has confirmed it was used in ransomware campaigns, meaning attackers are actively exploiting it in the real world. The fix exists (FTA_9_12_380 and later), and the ability to run OS commands without a login makes delays unusually dangerous. Treat it as an urgent, near-immediate patch/containment task.

1. Confirm exposure (version + reachability)

   • Identify the exact Accellion FTA version installed.
   • Determine whether your Accellion FTA is reachable from the internet or from any untrusted network segment.
   • Specifically confirm whether admin endpoints are exposed externally (not just the main site).

2. Determine whether you’re within the affected range

   • This issue affects Accellion FTA version 9_12_370 and earlier.

3. Apply the fix

   • Upgrade Accellion FTA to FTA_9_12_380 and later (per vendor remediation).
   • Plan for a normal upgrade window and validate after upgrade that the application and uploads/downloads still work as expected.

4. If you cannot upgrade immediately (temporary containment)

   • Block or restrict inbound access to Accellion FTA from the public internet.
   • Ensure admin endpoints are not accessible externally (allow access only from trusted networks, ideally only via a controlled management path).
   • If you use a reverse proxy/WAF, apply rules to block suspicious POST requests targeting administrative endpoints (use your vendor guidance where available).

5. Validate and monitor

   • After the change, review logs for suspicious activity: unexpected admin POST requests, repeated 4xx/5xx around admin paths, and indicators of command execution attempts.
   • If you find evidence of compromise, follow your incident response process (isolate the host, preserve logs, and rotate credentials as needed).

6. Reporting timeline guidance

   • CISA KEV listed this vulnerability with a remediation due date of 2021-11-17.

Severity is effectively critical given the impact described: remote operating-system command execution with no authentication required. The weakness is CWE-78 (improper neutralization of special elements used in an OS command). The triggering mechanism is a crafted POST request to Accellion FTA administrative endpoints, which can allow arbitrary OS command execution on the host. This item is in CISA KEV (added 2021-11-03) and was used in ransomware campaigns, so exploitation is treated as confirmed rather than theoretical. A public proof-of-concept exists (1 known). Patch guidance indicates fixed versions starting at FTA_9_12_380. Known exploit likelihood predictions exist but should not be used to downplay urgency because KEV-confirmed exploitation takes precedence.