Penetration Test Report (FireEye): ACCELLION FTA Security Assessment Summary 2021

ACCELLION, INC.
FILE TRANSFER APPLIANCE (FTA) SECURITY ASSESSMENT
MARCH 1, 2021
CONTENTS
EXECUTIVE SUMMARY ............................................................................................................................................3
Summary of Results ...........................................................................................................................................3
Project Scope .....................................................................................................................................................3
TECHNICAL DETAILS...............................................................................................................................................5
Timeline of Events ..............................................................................................................................................5
Forensic Analysis ...............................................................................................................................................6
Validation of Accellion’s Remediation of the Exploited Vulnerabilities ...............................................................8
Testing FTA for Additional Vulnerabilities ..........................................................................................................9
2
Executive Summary
Mandiant was engaged by Accellion, Inc. (Accellion) to perform a security assessment of Accellion's File Transfer
Appliance (FTA) software, in the wake of two related but distinct exploits used to attack client Accellion FTA
systems—one that was discovered and addressed by Accellion in December 2020 (the “December Exploit”), and
another that was discovered and addressed by Accellion in January 2021 (the “January Exploit”) (collectively, the
“Exploits”).
The objectives of Mandiant’s security assessment included:
 Independently identifying the security vulnerabilities used in the attack activity, based on review of
compromised Accellion FTA instances
 Validating the patches that Accellion issued for the vulnerabilities
 Testing FTA version 9.12.432 (current as of the time of Mandiant testing) for further vulnerabilities in the
software
This assessment was performed between February 4, 2021 and February 26, 2021.
Summary of Results
Accellion identified two zero-day vulnerabilities that were part of the December Exploit—CVE-2021-27101 and
CVE-2021-27104—and two zero-day vulnerabilities that were part of the January Exploit—CVE-2021-27102 and
CVE-2021-27103. Based on Mandiant’s own forensic analysis of a sample of compromised Accellion FTA
instances—which were provided to Mandiant by Accellion as well as impacted Accellion customers (in
investigations Mandiant conducted directly for those customers), Mandiant confirmed that the attacker activity
exploited these vulnerabilities (the “Exploited Vulnerabilities”). Mandiant did not identify any additional
vulnerabilities that were exploited by the attackers.1 Mandiant also validated the efficacy of the patches Accellion
released to address the Exploited Vulnerabilities, which Accellion made available to FTA customers soon after
each Exploit was identified.
The Exploited Vulnerabilities were of critical severity because they were subject to exploitation via
unauthenticated remote code execution. Through its source code analysis and penetration testing, Mandiant did
not identify any new such unauthenticated remote code-execution vulnerabilities. Mandiant did identify two
previously unknown authenticated-user vulnerabilities: (1) Argument Injection (CVE-2021-27730), accessible to
authenticated users with administrative privileges; and (2) Stored Cross-Site Scripting (CVE-2021-27731),
accessible to regular authenticated users. The Argument Injection finding yielded a Common Vulnerability Scoring
System (CVSS v3.0) score of 6.6 (medium severity) and the Stored Cross-Site Scripting finding was rated 8.1
(high severity). Accellion has developed a patch for these two vulnerabilities (FTA 9.12.444), which Mandiant has
validated.
Project Scope
Accellion FTA Vulnerability Identification: Mandiant reviewed the source code for Accellion FTA versions 9.12.370
through 9.12.432, as well as a sample of ten (10) forensic images from affected Accellion FTA instances, in order
to identify the vulnerabilities involved in the attack activity and to test for additional vulnerabilities. This review
involved the following methods:
1As explained in a separate blog post, Mandiant has attributed the attack activity on FTA systems to two
uncategorized threat groups—one that is believed to be responsible for compromising the systems (UNC2546),
and another that is believed to be responsible for engaging in extortion activity with respect to a subset of the
compromised customers (UNC2582).
3
1. Source code analysis
2. Dynamic penetration testing of Accellion FTA
3. Forensic analysis of compromised Accellion FTA appliances
Accellion FTA Patch Validation: Mandiant reviewed the Accellion FTA product version 9.12.432 (current as of the
time of Mandiant’s review) to validate that the version mitigated the Exploited Vulnerabilities. Mandiant then
attempted variations of exploits to determine if the 9.12.432 version of Accellion FTA could be exploited using
variations of the known attack vectors. The following areas were reviewed during this portion of the assessment:
1. Attempting alternative variations of the previously identified exploits
2. Attempting to exploit web pages and web services application programming interfaces (SOAP APIs)
not used by attackers
4
Technical Details
This section describes the scope and technical details for this assessment.
Timeline of Events
Below is a timeline of the relevant events, starting with the first detection of anomalous activity, up to the latest
Accellion FTA patch pushed to customers.
5
tiolpxE
rebmeceD
Exploit • Dec. 16, 2020: First known use of December Exploit: exploit trips FTA’s
built-in anomaly detector on customer’s device
Investigation • Dec. 16, 2020: Customer notifies Accellion that its anomaly detector was
triggered
Investigation • Dec. 16-19, 2020: Accellion investigates and identifies vulnerabilities affecting
FTA 9.12.370 – SQL Injection (CVE-2021-27101) and OS
Command Execution (CVE-2021-27104)
Mitigation • Dec. 20, 2020: Accellion releases patch FTA 9.12.380, which remediates
CVE-2021-27101 and CVE-2021-27104
Mitigation • Dec. 23, 2020: Accellion releases patch FTA 9.12.411, increasing
anomaly detector checks from one per day to one per hour
tiolpxE
yraunaJ
Exploit • Jan. 20, 2021: First known use of January Exploit (unknown to Accellion
at the time)
Exploit • Jan. 22, 2021: Through multiple customer service inquiries, Accellion
learns of anomalous activity indicative of new exploit
Mitigation • Jan. 22, 2021: Accellion issues critical security alert advising FTA
customers to shut down their FTA systems immediately
Mitigation • Jan. 22-25, 2021: Accellion investigates and identifies Server-Side Request
Forgery (CVE-2021-27103) and OS Command Execution
(CVE-2021-27102) vulnerabilities
Mitigation • Jan. 25, 2021: Accellion releases patch FTA 9.12.416, which remediates
CVE-2021-27102 and CVE-2021-27103
Mitigation • Jan. 28, 2021: Accellion releases patch FTA_9.12.432, increasing
frequency of anomaly detector checks to every 10 minutes
weiveR
tnaidnaM
Review • Feb. 4, 2021: Mandiant begins security assessment
Review • Feb. 28, 2021: Mandiant concludes assessment, identifying two new
findings – Argument Injection (CVE-2021-27730) and
Stored XSS (CVE-2021-27731)
Mitigation • Mar. 1, 2021: Accellion releases patch FTA 9.12.444, addressing CVE-
2021-27730 and CVE-2021-27731
Forensic Analysis
Materials Reviewed
In analyzing the Exploited Vulnerabilities previously identified by Accellion – SQL Injection (CVE-2021-27101),
Server-Side Request Forgery (SSRF) (CVE-2021-27103), and OS Command Execution (CVE-2021-27102, CVE-
2021-27104) – Mandiant had acc