Full Report
Our team is tracking in-the-wild exploitation of a zero-day vulnerability against Progress' MOVEit Transfer web application that allows for escalated privileges and unauthorized access.
Analysis Summary
# Vulnerability: MOVEit Transfer Critical SQL Injection and RCE
## CVE Details
- **CVE ID:** CVE-2023-34362 (Primary), CVE-2023-35036 (Additional SQLi vectors)
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-89 (SQL Injection)
## Affected Systems
- **Products:** Progress MOVEit Transfer (Web Application) and MOVEit Cloud.
- **Versions:** All versions prior to the June 2023 patches are considered vulnerable.
- **Configurations:** Systems with the web interface exposed to the internet.
## Vulnerability Description
The flaw is a SQL injection vulnerability in the MOVEit Transfer web application. An unauthenticated, remote attacker can leverage this injection to gain unauthorized access to the MOVEit Transfer database. Once database access is achieved, the attacker can escalate privileges, leak sensitive data, and achieve **Arbitrary Code Execution (RCE)**. Technical analysis shows that the attack chain can lead to full system compromise by running commands under the `moveitsvc` service account, which typically holds local administrator privileges.
## Exploitation
- **Status:** Exploited in the wild (Zero-day). Attributed to the "Lace Tempest" / cl0p ransomware group.
- **Complexity:** Low (Automated exploitation observed).
- **Attack Vector:** Network (Remote/Unauthenticated).
- **PoC Availability:** Publicly available (Recreated by Huntress, Rapid7, and Horizon3.ai).
## Impact
- **Confidentiality:** Total (Full access to all files and data stored in the transfer service).
- **Integrity:** Total (Ability to modify databases, delete files, and disable security software).
- **Availability:** Total (Deployment of ransomware and service disruption).
## Remediation
### Patches
Progress has released security updates for all supported MOVEit Transfer versions. Users should update to the latest fixed versions immediately:
- MOVEit Transfer 2023.0.1
- MOVEit Transfer 2022.1.8
- MOVEit Transfer 2022.0.4
- MOVEit Transfer 2021.1.4
- MOVEit Transfer 2021.0.6
### Workarounds
- Disable all HTTP and HTTPS traffic to the MOVEit Transfer environment (Ports 80 and 443).
- Modify firewall rules to restrict access to trusted IP addresses only.
- Delete any unauthorized user accounts and files (specifically `human2.aspx` or similar webshells).
## Detection
- **Indicators of Compromise (IoCs):** Presence of `human2.aspx` or other unexpected `.aspx` files in the `\wwwroot\` directory.
- **Detection Methods:**
- Use YARA rules to scan for the `human2.aspx` webshell.
- Monitor for large file downloads or unexpected data exfiltration from the MOVEit API.
- Check registry locations for enriched investigation (per Huntress technical guidance).
- Monitor for the creation of new, unauthorized administrative users in the MOVEit interface.
## References
- Progress Advisory: hxxps[://]community[.]progress[.]com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
- NVD CVE-2023-34362: hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2023-34362
- Huntress Blog: hxxps[://]www[.]huntress[.]com/blog/moveit-transfer-critical-vulnerability-rapid-response