Progress MOVEit Transfer Critical Vulnerability

A SQL injection vulnerability in the MOVEit Transfer web application is being actively exploited in the wild

Threat ID:: CC-4326
Threat Severity:: Medium
Published:: 1 June 2023 3:15 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

A SQL injection vulnerability in the MOVEit Transfer web application is being actively exploited in the wild

Affected platforms

The following platforms are known to be affected:

Versions: all MOVEit Transfer versions

Progress (formerly Ipswitch) MOVEit Transfer

Threat details

Take immediate action

The Progress MOVEit Transfer security advisory urges immediate mitigation action to prevent unauthorised access to MOVEit Transfer Environments and also to check for potential indicators of compromise (IoCs) over the past 30 days. Further detailed information, including IoCs and security updates, are included in the advisory.

Introduction

Progress (formerly Ipswitch) has released security updates and mitigations for a critical SQL injection vulnerability found in the MOVEit Transfer web application, a managed secure file transfer tool. The critical vulnerability could allow an unauthenticated, remote attacker to escalate privileges, gain access to the environment, and infer information about the structure and contents of the database. The attacker could also have the ability to execute SQL statements or delete database elements.

Active Exploitation in the wild

Several intelligence sources are reporting active exploitation in the wild. Affected organisations are strongly encouraged to review the advisory and take steps to mitigate and remediate the vulnerability.

The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2023-34362 to their Known Exploited Vulnerability Catalog.

Threat updates

Date	Update
5 Jun 2023	CVE added to NIST & CVE List This vulnerability has been changed to reflect the following: addition of a CVE number (CVE-2023-34362) CISA has added the number to their Known Exploited Vulnerabilities Catalog affected versions Remediation Step 3 has changed to reflect fixed versions for affected platforms Remediation Step 4 and Step 5 were presented in swapped in order added additional security best practices from MOVEit Transfer advisory Additionally, new IoCs were added to the security advisory.
2 Jun 2023	Changes to the security advisory and reports of active exploitation in the wild This cyber alert has been altered to reflect the following changes. The vulnerability has been announced on the advisory as being a SQL injection vulnerability. A CVE has not been announced. The recommended remediation has changed since this Cyber Alert was first issued. Three new steps have been added to prevent successful exploitation of the SQL injection vulnerability in MOVEit Transfer environments. Instructions in some of the previous steps have changed, especially in Step 2. Affected organisations are encouraged to follow the remediation listed in the advisory. Active exploitation has been reported in the wild.

Date

Update

5 Jun 2023

CVE added to NIST & CVE List

This vulnerability has been changed to reflect the following:

addition of a CVE number (CVE-2023-34362)
CISA has added the number to their Known Exploited Vulnerabilities Catalog
affected versions
Remediation Step 3 has changed to reflect fixed versions for affected platforms
Remediation Step 4 and Step 5 were presented in swapped in order
added additional security best practices from MOVEit Transfer advisory

Additionally, new IoCs were added to the security advisory.

2 Jun 2023

Changes to the security advisory and reports of active exploitation in the wild

This cyber alert has been altered to reflect the following changes.

The vulnerability has been announced on the advisory as being a SQL injection vulnerability. A CVE has not been announced.

The recommended remediation has changed since this Cyber Alert was first issued. Three new steps have been added to prevent successful exploitation of the SQL injection vulnerability in MOVEit Transfer environments. Instructions in some of the previous steps have changed, especially in Step 2. Affected organisations are encouraged to follow the remediation listed in the advisory.

Active exploitation has been reported in the wild.

Remediation advice

Affected organisations are encouraged to review the Progress Community advisory MOVEit Transfer Critical Vulnerability (May 2023) and immediately apply mitigations and updates as soon as practicable. Indicators of compromise are also included in the advisory.

Remediation steps

Type	Step
Action	Step 1: Disable all HTTP and HTTPs traffic to your MOVEit Transfer environment. More detailed information is in the security advisory.
Action	Step 2: Review, Delete and Reset Delete Unauthorised Files and User Accounts Reset Credentials More detailed information is in the security advisory.
Patch	Step 3: Apply the security update to a fixed version. All supported MOVEit Transfer versions are available, and a special patch is available for MOVEit Transfer 2020.1.x. More detailed information is in the security advisory.
Guidance	Step 4: Verification More detailed information is in the security advisory.
Guidance	Step 5: Enable all HTTP and HTTPs traffic to your MOVEit Transfer environment More detailed information is in the security advisory.
Guidance	Step 6: Continuous Monitoring More detailed information is in the security advisory.
Guidance	Please see here for MOVEit Security Best Practices

Definitive source of threat updates

CVE Vulnerabilities

Status Published

CVE-2023-34362

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.

Last edited: 5 June 2023 3:09 pm