Huntress Recreates MOVEit Transfer Exploit Chain, Demonstrating Arbitrary Code Execution

Jun 1, 2023 · Original article ↗

Summary

Huntress reconstructed exploitation of MOVEit Transfer’s SQL injection flaw, showing how it could lead to arbitrary code execution. The article details observed artifacts, hunting guidance and patches; Microsoft attributed the threat to Lace Tempest.

Key points

Huntress reported active exploitation attempts after Progress issued a critical MOVEit Transfer security advisory; the vulnerability was identified as CVE-2023-34362.
Huntress reconstructed a chain in which SQL injection could enable administrative access and arbitrary code execution. In a demonstration, the researchers obtained shell access and ran a ransomware payload.
In one affected organization, Huntress observed IIS activity and a newly compiled DLL associated with the human2.aspx webshell; it reported a full attack chain at that host.
The webshell could retrieve files, expose database information, or create an administrative account and active session, depending on supplied headers.
Huntress published hunting guidance, including process-monitoring, YARA and Sigma rules, and suggested checking IIS logs, webroot files and temporary ASP.NET compilation artifacts.
Progress’s recommended mitigation was to install a patched MOVEit Transfer version; if patching was not feasible, it advised blocking HTTP(S) access to the service, which would take it out of service.
Huntress later reported CVE-2023-35036 for additional SQL injection vectors and database data leakage. Microsoft attributed the threat to Lace Tempest, which it associated with the cl0p ransomware group.

Article Details

Attack Vectors: Unauthenticated SQL injection in the MOVEit Transfer web application, including requests to moveitisapi.dll with specific headers, could enable administrative access, data theft, and arbitrary code execution.
The observed attack chain staged a human2.aspx webshell, which could create a database admin account, retrieve files, and return file and database information.
Huntress demonstrated that the vulnerability could be exploited to obtain shell access and run a ransomware payload; it reported this as a recreated proof of concept.
Defensive Notes: Apply a patched MOVEit Transfer version: 2023.0.1, 2022.1.5, 2022.0.4, 2021.1.4, or 2021.0.6.
If patching is not feasible, Progress recommends blocking HTTP(S) traffic to MOVEit Transfer on ports 80 and 443, with the understanding that this takes the application out of service.
Enable logging and review IIS access logs for activity involving guestaccess.aspx, moveitisapi.dll, and human2.aspx.
Investigate for C:\MOVEitTransfer\wwwroot\human2.aspx and unexpected compiled DLLs in Temporary ASP.NET Files; Huntress notes that a second App_Web_….dll may indicate the backdoor was compiled.
Huntress recommends reviewing the MOVEit registry locations for WebBaseDir and LogsBaseDir to identify installation and log paths.

Indicators of compromise

Type	Indicator	Context
IPV4	`138[.]197[.]152[.]201`	Listed as an indicator of attack IP address associated with the MOVEit exploitation reporting.
IPV4	`148[.]113[.]152[.]144`	Community-reported IP listed among indicators of attack for the MOVEit incident.
IPV4	`209[.]97[.]137[.]33`	Listed as an indicator of attack IP address associated with the MOVEit exploitation reporting.
IPV4	`5[.]252[.]190[.]116`	Source IP observed making a request to guestaccess.aspx during the reported attack sequence.
IPV4	`5[.]252[.]190[.]181`	Source IP in the reported IIS access-log sequence preceding the MOVEit exploitation activity.
IPV4	`5[.]252[.]190[.]233`	Source IP observed making requests to MOVEit endpoints during the reported attack sequence.
IPV4	`5[.]252[.]191[.]14`	Source IP observed making requests to MOVEit endpoints during the reported attack sequence.
IPV4	`5[.]252[.]191[.]88`	Source IP observed requesting human2.aspx during the reported attack sequence.
IPV4	`89[.]39[.]105[.]108`	Listed as an indicator of attack IP address associated with the MOVEit exploitation reporting.