id: CVE-2025-10035

info:
  name: "Goanywhere - Command Injection"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a
    validly forged license response signature to deserialize an arbitrary actor-controlled object, possibly
    leading to command injection.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-10035&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=goanywhere&match=exact
  classification:
    cve-id: CVE-2025-10035
  metadata:
    verified: false
  tags: cve,cve2025,goanywhere,auth-bypass,vkev,kev,vuln
variables:
  string: "{{to_lower(rand_text_alpha(5))}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/goanywhere/license/Unlicensed.xhtml/{{string}}?javax.faces.ViewState={{string}}&GARequestAction=activate"
      - "{{BaseURL}}/license/Unlicensed.xhtml/{{string}}?javax.faces.ViewState={{string}}&GARequestAction=activate"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - contains_all(location, "request?bundle=", "my.goanywhere.com")
          - status_code == 302
        condition: and

    extractors:
      - type: dsl
        dsl:
          - location