CVE-2021-27103: Accellion FTA Server-Side Request Forgery (SSRF) Vulnerability

CVE-2021-27103 is a server-side request forgery (SSRF) vulnerability in Accellion FTA. An attacker can abuse it with a crafted POST request to wmProgressstat.html, potentially allowing the server to make unintended requests. This matters because Accellion FTA is used for secure file transfer; successful exploitation can expose internal systems or data, and the vulnerability has been used in ransomware operations. Confirm all product and version details against the vendor advisory.

How it works

This flaw falls under CWE-918 (Server-Side Request Forgery). In an SSRF weakness, the application accepts attacker-controlled input that influences outbound requests made by the server itself. According to the CISA summary, the issue in Accellion FTA is triggered via a crafted POST request to the wmProgressstat.html endpoint. A technical reader should understand that the attacker does not need to reach internal hosts directly; instead they coerce the FTA server into initiating connections or requests on their behalf. Exact request parameters, response behavior, and any chaining with other flaws are not detailed in the provided facts and must be confirmed against the vendor advisory. Do not assume specific payloads or internal targets beyond the general SSRF class.

Am I affected? How to find it in your systems

Accellion FTA is typically deployed as an on-premises or appliance-based secure file-transfer solution, often facing the internet or partner networks to handle external file exchange. Inventory any hosts or virtual appliances running Accellion FTA software. Check management consoles, asset databases, and network scans for FTA-related services or hostnames. Because exact affected version ranges are not supplied here, compare your installed build against the vendor advisory before declaring a system safe or vulnerable.

• Search configuration management and vulnerability scanners for “Accellion FTA” or related package names.
• Review web-server or application logs for POST requests to wmProgressstat.html, especially from unexpected sources or with anomalous parameters.
• Look for unusual outbound connections originating from the FTA host to internal IP ranges, metadata endpoints, or unexpected external destinations—classic SSRF telemetry.
• Confirm whether the service is internet-exposed; exposure increases risk of opportunistic exploitation.

Absence of obvious log hits does not prove non-exploitation; SSRF traffic can be low-volume and blend with legitimate activity.

How to remediate

Patch first. CISA’s required action is to apply updates per vendor instructions. Obtain the fixed release or security update directly from the Accellion (or successor) advisory for CVE-2021-27103 and install it on every FTA instance. After patching, verify the version string and re-test the previously vulnerable endpoint if the vendor provides a verification method.

Beyond the patch, harden the broader class of SSRF risks:

• Restrict the FTA server’s ability to initiate outbound connections; allow only required destinations via egress firewall rules or proxy allow-lists.
• Disable or remove any unused web endpoints and administrative interfaces.
• Ensure the service runs with least privilege and is isolated from sensitive internal networks where practical.
• Keep the underlying OS and supporting components current so that secondary attack paths are reduced.

If you can't patch immediately

Implement compensating controls while you schedule the update:

• Network segmentation: place FTA hosts in a tightly controlled DMZ or enclave with strict ingress and egress filtering; block the server from reaching internal RFC 1918 space, cloud metadata services, and non-essential external hosts.
• Virtual patching / WAF: if a web application firewall sits in front of FTA, add a rule to block or tightly validate POST requests to wmProgressstat.html until the vendor patch is applied. Test rules to avoid breaking legitimate use.
• Feature reduction: if the affected functionality can be disabled without halting critical business processes, turn it off.
• Heightened monitoring: alert on POSTs to wmProgressstat.html, on anomalous outbound connections from the FTA host, and on any authentication or file-transfer anomalies that might indicate follow-on activity. Retain logs for forensic review.

These measures reduce but do not eliminate risk; treat them as temporary.

If your data may have been exposed

Actively exploited vulnerabilities, including those with known ransomware use, frequently lead to data theft or encryption. If you have evidence of exploitation or cannot rule it out, treat the incident as a potential breach: isolate affected systems, preserve logs, and follow your incident-response plan. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether credentials or personal information have already appeared in public dumps.