CVE-2021-27102

CVE-2021-27102 is an OS command injection flaw (CWE-78) in Accellion's legacy File Transfer Appliance (FTA) that permits operating-system command execution through a call to a local web service in FTA 9_12_411 and earlier. An attacker who can invoke that service can run arbitrary commands with high impact on the appliance's confidentiality, integrity, and availability (CVSS 3.1 base 7.8, local vector, low privileges, no user interaction); in the widely reported late-2020/early-2021 campaign, this flaw was exploited alongside other FTA zero-days and the DEWMODE web shell to steal data from organizations using the appliance. Any organization running Accellion FTA 9_12_411 or earlier, typically enterprises and government agencies using the on-prem appliance for secure large-file transfer, is affected. Exploitation is confirmed in the wild: the flaw is in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03) with known ransomware use, EPSS assigns a 3.7% 30-day exploitation probability (89th percentile), and related reporting ties it to the Clop data-theft extortion campaign, including the breach of cybersecurity firm Qualys. The vulnerability is fixed in FTA_9_12_416 and later.

What to do: Upgrade all FTA appliances to FTA_9_12_416 or later per vendor instructions, as required by the CISA KEV listing, and given FTA's legacy status consider migration to the vendor's current platform. Hunt for prior compromise, since the associated campaign deployed the DEWMODE web shell, by reviewing web-server and process logs on the appliance and checking for unexpected web shells, and keep the FTA web interface off the public internet until patched.