Revision History

SQL Injection (CVE-2023-34362)
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.

Affects

Recommended Remediation

More specifically, modify firewall rules to deny HTTP and HTTPs traffic to MOVEit Transfer on ports 80 and 443 until the patch can be applied.

1. Delete Unauthorized Files and User Accounts
   1. Delete any instances of the human2.aspx (or any files with human2 prefix) and .cmdline script files.
   2. On the MOVEit Transfer server, look for any new files created in the C:\MOVEitTransfer\wwwroot\ directory.
   3. On the MOVEit Transfer server, look for new files created in the C:\Windows\TEMP\[random]\ directory with a file extension of [.]cmdline
   4. On the MOVEit Transfer server, look for new APP_WEB_[random].dll files created in the C:\Windows\Microsoft. NET\Framework64\[version]\Temporary ASP .NET Files\root\[random]\[random]\ directory:
      • Stop IIS (iisreset /stop)
      • Delete all APP_WEB_[random].dll files located in C:\Windows\Microsoft. NET\Framework64\[version]\Temporary ASP. NET Files\root\[random]\[random]\
      • Start IIS (iisreset /start). Note: The next time the web application is accessed, they will be rebuilt properly. It is normal to have 1 APP_WEB_[random].dll file located in this directory.
   5. Remove any unauthorized user accounts. See Progress MOVEit Users Documentation article.
   6. Remove all active sessions. The steps to remove all active sessions are listed below. More information can be found in the Admin Features on the Home Page guide:
      • Log in as a System Administrator.
      • Navigate to Session Manager
      • Select “Remove All Sessions”
   7. Review logs for unexpected downloads of files from unknown IPs or large numbers of files downloaded. For more information on reviewing logs, please refer to MOVEit Transfer Logs guide.
   8. Review IIS logs for any events including GET /human2.aspx.  Large numbers of log entries or entries with large data sizes may indicate unexpected file downloads

   9. If applicable, review Azure logs for unauthorized access to Azure Blob Storage Keys and consider rotating any potentially affected keys. 

2. Reset Service Account Credentials
   1. Reset service account credentials for affected systems and MOVEit Service Account. See KB 000115941.

1. To confirm the files have been successfully deleted and no unauthorized accounts remain, follow steps 2A again. If you do find indicators of compromise, you should reset the service account credentials again.

1. Monitor network, endpoints, and logs for IoCs (Indicators of Compromise) as listed in the table below.

Additional Security Best Practices

• Update network firewall rules to only allow connections to the MOVEit Transfer infrastructure from known trusted IP addresses.
• Review and remove any unauthorized user accounts. See Progress MOVEit Users Documentation article.
• Update remote access policies to only allow inbound connections from known and trusted IP addresses. For more information on restricting remote access, please refer to SysAdmin Remote Access Rules and Security Policies Remote Access guide.
• Allow inbound access only from trusted entities (e.g., using certificate-based access control).
• Enable multi-factor authentication. Multi-factor authentication (MFA) protects MOVEit Transfer accounts from unverified users when a user's account password is lost, stolen, or compromised. To enable MFA, please refer to the MOVEit Transfer Multi-factor Authentication Documentation.

Indicators of Compromise

See file attachment cve-2023-34362-iocs located at the bottom of this article.

If you do notice any of the indicators noted above, please immediately contact your security and IT teams and open a ticket with Progress Technical Support at: https://community.progress.com/s/supportlink-landing. 

References

• MOVEit Security Best Practices Guide
• Upgrade and/or Migration Guide for MOVEit Automation and MOVEit Transfer
• CVE-2023-34362 (NIST)
• CVE-2023-34362 (MITRE)
• Mandiant MOVEit Zero-Day Blog
• Velociraptor - MOVEIt CVE-2023-34362 Detection
• Rapid7 Observed Exploitation of Critical MOVEit Transfer Vulnerability
• Microsoft Security Intelligence
• Movin’ Out: Identifying Data Exfiltration in MOVEit Transfer Investigations
• CISA Cyber Security Advisory: #StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability
• Huntress MOVEit Transfer Critical Vulnerability CVE-2023-34362 Rapid Response

*Special thank you to Mandiant, Crowdstrike, Rapid7, Microsoft, CISA, and Huntress.