MOVEit Transfer zero day CVE-2023-34362 is a critical SQL injection flaw in Progress Software’s managed file transfer product. It scores 9.8 (critical) on the CVSS v3.1 scale, needs no login, and was exploited from late May 2023. CISA attributes the attacks to the CL0P ransomware gang, also known as TA505. Apply the vendor patches and check your servers for compromise.
What is the MOVEit Transfer zero day, CVE-2023-34362?
Ipswitch, a subsidiary of Progress Software Corporation, has been hit by a major cybersecurity vulnerability exploited by unknown hackers to attack its MOVEit Transfer software. The software is a popular application for businesses and customers to transfer data securely. Identified as CVE-2023-34362 – a zero-day vulnerability – Progress Software Corporation has issued a critical security advisory warning its customers to take precautionary measures immediately.
The software developer advises all its customers to restrict access to external traffic to ports 80 and 443 on MOVEit Transfer servers until patches have been installed. While Progress notes that the recommendation is necessary, it also concedes that it will affect the operations of certain applications such as MOVEit Automation tasks, API functions, and the plugin functionality of the Outlook MOVEit Transfer.
- CVE id
- CVE-2023-34362
- Product
- MOVEit Transfer (Progress Software)
- Flaw type
- SQL injection (CWE-89), no login needed
- CVSS v3.1
- 9.8, critical
- CVE published
- 2 June 2023
- First fixed in (CVE text)
- 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5 and 2023.0.1
The software is vulnerable to SQL injection that leads to remote code execution. A common feature of all exploited devices is the ‘human2.aspx’ webshell, which can execute a series of commands if accessed with the correct password. Scarily, these commands enable the attacker to retrieve vast amounts of data from the server, such as lists of stored files, user details, and Azure Blob Storage account configurations.
Reportedly several admins have reported discovering multiple unexpected files post-breach. What is worrying is that the breach likely began over the long Memorial Day weekend in the United States when system monitoring is often at its minimum.
With a potential for data theft and exposure, cybersecurity experts are warning organizations to shut down their MOVEit Transfers until the issue is resolved and a comprehensive investigation for compromise has been conducted.
Experts strongly suggest that all organizations using MOVEit Transfer should acquire a forensic examination to ascertain whether their system was compromised and if data was stolen. Furthermore, Progress Software has confirmed that its cloud platform was impacted, potentially broadening the scope of victims. The company has released mitigation steps for on-premise and cloud-based systems, and experts recommend organizations follow them.
The attacks exploiting the CVE-2023-34362 MOVEit Transfer 0-day vulnerability are attributed by CISA to the CL0P Ransomware Gang, also known as TA505, which began exploiting the flaw on May 27, 2023. CISA’s advisory AA23-158A also publishes IOCs, including file hashes, IP addresses and domains.
- Restrict external trafficBlock ports 80 and 443 on MOVEit Transfer servers until patches are installed.
- Install the patchesApply the vendor fix for your MOVEit Transfer version.
- Check for compromiseHave a forensic examination done to see whether data was stolen.
- Follow the mitigation stepsUse the vendor steps for on-premise and cloud-based systems.
Was MOVEit the second MFT 0-day in six months?
Cl0p Ransomware Gangs Announced They Exploited Many Organizations
The zero day vulnerability in the GoAnywhere file-sharing software is tracked with the code CVE-2023-0669 and was first discovered on February 3, 2023. On February 6, 2023, an exploit code was released for this vulnerability, and by February 10, 2023, Cl0p operators had announced that they had used the exploit to attack many organizations… [Read More]
How Can Brandefense Help You?
Our innovative service offers a range of benefits that can help you stay ahead of cybercriminals and protect your brand reputation. With early detection of cyber threats, you’ll have more time to respond and prevent potential data breaches or other attacks. Our dark web monitoring can enhance your overall security posture and protect your sensitive data and assets.
Brandefense Dark Web Monitoring Solution
Early Detection of Cyber Threats: Dark web monitoring allows businesses to detect cyber threats early on, giving them more time to respond and prevent potential data breaches or other attacks.
Enhanced Security: By monitoring the dark web for potential threats, businesses can stay ahead of cybercriminals and protect their sensitive data and assets.
Brand Protection: Dark web monitoring can also help businesses protect their brand reputation by detecting any attempts to sell counterfeit products or impersonate their brand.
Cost-Effective: The cost of a data breach can be substantial in terms of financial losses and damage to brand reputation. Dark web monitoring is a cost-effective way to mitigate these risks and prevent costly cyber attacks.
Contact us today to learn more about how Brandefense’s dark web monitoring service can help you protect your business and achieve peace of mind.
Dark Web Monitoring We know what hackers know about you Discover the Solution
Other file transfer tools, among them CrushFTP and Fortra GoAnywhere MFT, were later flagged by CISA for known ransomware campaign use. See Remote support and file transfer flaws in ransomware attacks.