MOVEit Transfer CVE-2023-34362: Anatomy of a Critical SQL Injection and Real-World Exploitation

Introduction

In late May 2023, a wave of ransomware attacks hit government agencies and enterprises worldwide through a previously unknown flaw in Progress Software's MOVEit Transfer. The Clop ransomware group ran the campaign, compromising data from thousands of organizations and exposing weaknesses in managed file transfer infrastructure. CVE-2023-34362, a critical SQL injection vulnerability (CVSS 9.8), was the center of it. The flaw let unauthenticated attackers take control of MOVEit Transfer databases, deploy persistent web shells, and run extortion operations at scale.

About MOVEit Transfer and Progress Software:

MOVEit Transfer is a managed file transfer (MFT) solution from Progress Software, used in sectors where secure data exchange is mission-critical. The platform has a large footprint in government, healthcare, and financial services, including U.S. federal agencies and Fortune 500 companies. Progress Software is a major player in secure file transfer, and in 2023 it faced heavy scrutiny over a series of critical vulnerabilities in its flagship product line.

Technical Information

CVE-2023-34362 is a SQL injection vulnerability affecting MOVEit Transfer versions prior to 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, and 2023.0.1. The flaw sits in the web application's HTTP/S request handlers, which did not sufficiently sanitize user-supplied input before building SQL queries. Attackers exploited this by sending crafted requests, most notably to the /human.aspx endpoint, that embedded malicious SQL statements the backend database would execute (unit42.paloaltonetworks.com, blog.qualys.com).

The attack chain ran as follows:

1. Initial Access via SQL Injection: Unauthenticated attackers sent crafted HTTP or HTTPS requests to vulnerable MOVEit Transfer endpoints. The SQL injection let them enumerate the database schema, extract credentials, and escalate privileges.

2. Web Shell Deployment: With elevated access, attackers deployed a custom web shell known as LEMURLOOT (human2.aspx) to the wwwroot directory. This web shell gave persistent access, ran commands, and helped with further data exfiltration (cisa.gov, blog.qualys.com).

3. Data Exfiltration and Extortion: Attackers used the web shell to steal sensitive files, database contents, and Azure storage keys. They then used the stolen data for extortion, threatening victims through the Clop leak site (sentinelone.com).

The vulnerability worked against MOVEit Transfer deployments using MySQL, Microsoft SQL Server, or Azure SQL as the backend. Forensic investigations found that the attackers had mapped the database schema in advance, which points to extensive reconnaissance and pre-exploitation research (kroll.com).

Proof of Concept

The proof-of-concept (PoC) exploit for CVE-2023-34362, developed by Horizon3, demonstrates remote code execution on vulnerable MOVEit Transfer systems through SQL injection.

Exploit Overview:

1. SQL Injection to Obtain Sysadmin API Token: The exploit starts by using the SQL injection flaw to retrieve a sysadmin API access token from the MOVEit Transfer database.

2. Abuse of Deserialization for RCE: With the sysadmin API token, the attacker interacts with application API endpoints and targets a deserialization function. Injecting a malicious payload into this process gives arbitrary code execution on the server.

Technical Details:

• Identity Provider Endpoint: The PoC needs an Identity Provider (IDP) endpoint hosting RS256 certificates to forge arbitrary user tokens. By default, Horizon3's AWS-hosted IDP endpoint is used.
• Payload Execution: The default PoC writes a file named message.txt to C:\Windows\Temp\ on the target system to demonstrate code execution.
• Alternative Payloads: Custom payloads can be generated with the ysoserial.net project.

Usage Example:

python CVE-2023-34362.py https://target-url

Disclaimer: The PoC is for educational and research purposes only. Unauthorized use is illegal and unethical.

PoC Source: https://github.com/horizon3ai/CVE-2023-34362

Patch Information

Progress Software has released patches for MOVEit Transfer to address CVE-2023-34362. Users should upgrade to one of the following fixed versions:

• 2021.0.6
• 2021.1.4
• 2022.0.4
• 2022.1.5
• 2023.0.1

For MOVEit Transfer 2020.1.x (12.1), a special patch is available. Users of MOVEit Transfer 2020.0.x (12.0) or older should upgrade to a supported version. If you cannot upgrade right away, disable HTTP and HTTPS traffic to MOVEit Transfer by blocking ports 80 and 443 at the firewall. SFTP and FTP will keep working. These mitigations are not a substitute for patching and should be temporary.

Patch Source: https://www.tenable.com/blog/cve-2023-34362-moveit-transfer-critical-zero-day-vulnerability-exploited-in-the-wild

Detection Methods

Detecting exploitation of CVE-2023-34362 takes close monitoring for indicators of compromise (IoCs):

File Activity Monitoring:

• Watch the wwwroot directory for new files with extensions such as .aspx, .dll, .exe, .ps1, .vbs, .vbe, .bat, .cmd, .zip, .rar, and .7z.
• Watch for files named _human2.aspx or human2.aspx in wwwroot, which are tied to exploitation attempts.

Log Analysis:

• Enable and review database logs for unexpected SQL statements or errors that suggest SQL injection.
• Check MOVEit Transfer logs for msg_post actions with unusual IP addresses or user agents.

Network Traffic Monitoring:

• Monitor for anomalous HTTP/HTTPS requests to MOVEit Transfer, especially those with unusual parameters or payloads.
• Watch for large outbound data transfers from the server to external IPs, which may indicate data exfiltration.

Endpoint Detection and Response (EDR):

• Use EDR tools to catch unexpected processes or scripts running on the MOVEit Transfer server.

Recommendations:

• Audit file systems, logs, and network traffic regularly.
• Patch MOVEit Transfer to the latest version.
• Restrict server access and watch for unauthorized attempts.

Detection Sources:

• detection.fyi
• attackerkb.com
• rapid7.com
• cisa.gov

Affected Systems and Versions

CVE-2023-34362 affects the following MOVEit Transfer versions:

• All versions before 2021.0.6 (13.0.6)
• All versions before 2021.1.4 (13.1.4)
• All versions before 2022.0.4 (14.0.4)
• All versions before 2022.1.5 (14.1.5)
• All versions before 2023.0.1 (15.0.1)
• All older, unsupported versions (including 2020.0.x, 2019.x, and earlier)

The vulnerability is present regardless of backend database configuration (MySQL, Microsoft SQL Server, or Azure SQL).

Vendor Security History

Progress Software saw three critical SQL injection vulnerabilities in MOVEit Transfer within a single month in 2023: CVE-2023-34362, CVE-2023-35036, and CVE-2023-35708. Each let unauthenticated attackers compromise the application. The vendor responded with rapid patches and architectural changes, but the repeat of similar vulnerabilities pointed to ongoing problems in secure development and vulnerability management.

References

• NVD CVE-2023-34362
• CISA Advisory
• Rapid7 Analysis
• Palo Alto Unit42 Threat Brief
• SentinelOne Threat Analysis
• Kroll Incident Response
• Qualys Technical Blog
• Tenable Patch Guidance
• Horizon3 PoC
• Detection Sigma Rule
• Rapid7 Detection Timeline
• CISA Advisory

Source: This report was created using AI

If you have suggestions for improvement or feedback, please reach out to us at [email protected]