{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-10035/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-10035/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-10035/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-10035/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-10035/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-10035"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-10035"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2025/CVE-2025-10035.yaml",
    "nuclei_template_severity": "critical",
    "nuclei_template_yaml": "id: CVE-2025-10035\n\ninfo:\n  name: GoAnywhere - Authentication Bypass\n  author: DhiyaneshDk,watchtowr\n  severity: critical\n  description: |\n    Fortra GoAnywhere MFT contains an insecure deserialization vulnerability in the License Servlet caused by deserializing attacker-controlled objects with a valid forged license response signature, letting attackers perform command injection, exploit requires valid forged license signature.\n  reference:\n    - https://labs.watchtowr.com/is-this-bad-this-feels-bad-goanywhere-cve-2025-10035/\n    - https://attackerkb.com/topics/LbA9ANjcdz/cve-2025-10035/rapid7-analysis\n    - https://www.fortra.com/security/advisories/product-security/fi-2025-011\n  impact: |\n    Attackers can execute arbitrary commands remotely, potentially leading to full system compromise.\n  remediation: |\n    Update to the latest version with the deserialization fix.\n  metadata:\n    verified: true\n    max-request: 1\n    shodan-query: title:\"GoAnywhere\"\n    fofa-query: title=\"GoAnywhere\"\n  tags: cve,cve2025,goanywhere,auth-bypass,vkev,kev,vuln\n\nvariables:\n  string: \"{{to_lower(rand_text_alpha(5))}}\"\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/goanywhere/license/Unlicensed.xhtml/{{string}}?javax.faces.ViewState={{string}}&GARequestAction=activate\"\n      - \"{{BaseURL}}/license/Unlicensed.xhtml/{{string}}?javax.faces.ViewState={{string}}&GARequestAction=activate\"\n\n    stop-at-first-match: true\n    matchers:\n      - type: dsl\n        dsl:\n          - contains_all(location, \"request?bundle=\", \"my.goanywhere.com\")\n          - status_code == 302\n        condition: and\n\n    extractors:\n      - type: dsl\n        dsl:\n          - location\n# digest: 490a00463044022008481d436f08c510437db7dc1c8f2887b8d2717d70b169a2965f6931207806b902206475ce7d23c2a4fbf7577133b83298373d60745fee36442a47b3bbc8854a8104:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2025-10035"
}