MOVEit Transfer SQL injection

What it does

A SQL injection in the MOVEit Transfer web interface allows an unauthenticated attacker to read and modify the underlying database. Chained with further flaws it leads to code execution on the server.

The Cl0p ransomware group exploited it as a zero-day over the US Memorial Day weekend in 2023, deploying the LEMURLOOT web shell (human2.aspx) and exfiltrating files from hundreds of organisations.

MOVEit is a managed file transfer product, so a single compromised instance often yields sensitive data belonging to many downstream customers.

Remediation

1. Upgrade to the fixed release for your version train and apply subsequent MOVEit patches (CVE-2023-35036, CVE-2023-35708).
2. Search the wwwroot directory for unexpected .aspx files, especially human2.aspx, and review IIS logs for POST requests to /moveitisapi/moveitisapi.dll.
3. Reset service account credentials and any stored SFTP or Azure storage keys.

Enumeration

Detection templates and scanners you can run to find exposed instances on your own attack surface.

$ nuclei -id CVE-2023-34362 -u https://TARGET

Exploitation

Working exploit modules and public PoCs. Use only against systems you own or are authorized to test.

$ msfconsole -q -x "use exploit/windows/http/moveit_cve_2023_34362; show options"

$ git clone https://github.com/horizon3ai/CVE-2023-34362.git

References

• Progress community advisorycommunity.progress.com
• CISA advisory AA23-158Awww.cisa.gov
• NVD recordnvd.nist.gov