MOVEit Transfer SQL Injection RCE
- Product
- Progress MOVEit Transfer
- CVE
- CVE-2023-34362
- Disclosed
- 2023-05-31
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), 2023.0.1 (15.0.1).
- Fixed
- 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, 2023.0.1.
Summary
The Cl0p ransomware group exploited a zero-day SQL injection in MOVEit Transfer over a holiday weekend to steal data from thousands of organizations. It became one of the largest data-theft campaigns ever recorded.
Root cause
An unauthenticated request path via the moveitisapi.dll and guestaccess.aspx components allowed manipulation of session state and SQL injection into the backing database. Attackers used it to obtain a privileged session and then reach a deserialization sink, achieving code execution and deploying the LEMURLOOT webshell.
Impact
Unauthenticated code execution and bulk exfiltration of stored files.
Detection
Look for human2.aspx or other unexpected .aspx files in wwwroot, requests to /moveitisapi/moveitisapi.dll?action=m2 and /guestaccess.aspx, and X-siLock-Comment headers. Nuclei template CVE-2023-34362.
Mitigation
Apply patches, block HTTP/HTTPS to MOVEit until patched, and hunt for LEMURLOOT artifacts.