cyber.hendryadrian.com
Vulnerability & Exploit · wiz.io

MOVEit Transfer Flaws Exploited in the Wild; Progress Releases Fixes

· Original article ↗

Summary

Progress disclosed three critical MOVEit Transfer flaws in 2023, including an exploited SQL injection vulnerability. The article lists affected and fixed versions and urges patching, restricting exposure, and rotating potentially compromised credentials.

Key points

  • CVE-2023-34362 is an SQL injection flaw that could let an unauthenticated attacker access the MOVEit Transfer database; exploitation was observed from May 2023.
  • Progress disclosed two additional critical SQL injection flaws: CVE-2023-35036 on June 9 and CVE-2023-35708 on June 15, 2023.
  • Progress published fixed versions for affected major releases from 2020.1.x through 2023.0.0.
  • Microsoft attributed exploitation of CVE-2023-34362 to Cl0p; the group also claimed responsibility. Multiple organizations disclosed compromises, and Cl0p named companies it claimed to have targeted and exfiltrated data from.
  • GreyNoise observed MOVEit login-page scanning from March 3, 2023; Kroll identified potentially related activity dating to June 2021.
  • The article recommends immediately patching, prioritizing internet-exposed instances, and temporarily blocking HTTP access as Progress advised.
  • Organizations that suspect compromise should consider rotating relevant cloud-storage keys and database credentials; the article also recommends placing MOVEit behind a firewall, VPN, or SSO landing page.

Article Details

Vulnerability Types
  • SQL injection
  • Remote code execution
Severity
Critical
Affected Versions
  • MOVEit Transfer 2023.0.0
  • MOVEit Transfer 2022.1.x
  • MOVEit Transfer 2022.0.x
  • MOVEit Transfer 2021.1.x
  • MOVEit Transfer 2021.0.x
  • MOVEit Transfer 2020.1.x
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Temporarily block HTTP access to MOVEit Transfer and rely on FTP instead.

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationAn unauthenticated attacker exploited the MOVEit Transfer web application, including publicly exposed instances.

CVE

CVE-2023-34362On May 31, 2023, Progress published details of a critical remote code execution (RCE) 0-day vulnerability in MOVEit Transfer being exploited in-the-wild (CVE-2023-34362).CVE-2023-350362023, Progress published details of a second critical SQL injection vulnerability in MOVEit Transfer (CVE-2023-35036). An attacker could submit a crafted payload to a MOVEit Transfer application endpoint which couldCVE-2023-35708On June 15, 2023, Progress published details of a third critical SQL injection vulnerability in MOVEit Transfer (CVE-2023-35708).

Threat Actors

Cl0pMicrosoft attributed exploitation of CVE-2023-34362 to Cl0p; the group also claimed responsibility and said it targeted companies and exfiltrated their data.

Vendors

IpswitchMOVEit Transfer is a Windows-Server-based managed file transfer (MFT) service developed by Ipswitch, a subsidiary of Progress.Progress SoftwareOn May 31, 2023, Progress published details of a critical remote code execution (RCE) 0-day vulnerability in MOVEit Transfer being exploited in-the-wild (CVE-2023-34362).

Products

Progress MOVEit TransferOn May 31, 2023, Progress published details of a critical remote code execution (RCE) 0-day vulnerability in MOVEit Transfer being exploited in-the-wild (CVE-2023-34362).

Related Articles