Progress MOVEit Transfer SQL Injection Vulnerability
Zero-day vulnerability exploited in data theft attacks
https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
A SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. According to the vendor, depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to gather information about the structure and contents of the database and execute SQL statements that can change or delete database elements..
Background
MOVEit Transfer is a managed file transfer (MFT) solution developed by Ipswitch, a subsidiary of Progress Software Corporation, that allows the enterprise to securely transfer files between business partners and customers using SFTP, SCP, and HTTP-based uploads. Previously during Feb of this year, we saw a different MFT solution, Fortra GoAnywhere MFT exploited by attackers for ransomware attacks on various organizations which shows file transfer solution remain a target for ransomware attacks. To read the full Outbreak Report, go to Additional Resources section below.
Announced
May 31, 2023: Vulnerability was announced by Progress Software Corporation. June 2, 2023: CISA added CVE-2023-34362 to its Known Exploited Vulnerability catalog (KEV)
Latest Developments
June 2, 2023: FortiGuard Labs released a Threat Signal on Progress MOVEit Transfer SQL Injection Vulnerability. June 4, 2023: Microsoft links attacks exploiting the CVE-2023-34362 MOVEit Transfer 0-day vulnerability to Lace Tempest aka Cl0p ransomware group. June7, 2023: CISA released a Cybersecurity Advisory. "Ransomware Gang Exploits CVE-2023-34362 MOVEit Vulnerability" June 8, 2023: FortiGuard Threat Labs released a detailed blog on CVE-2023-34362 June 9, 2023: Another SQL injection vulnerability (CVE-2023-35036) have been identified in the MOVEit Transfer web application that could allow an un-authenticated attacker to gain unauthorized access to the MOVEit Transfer database. June 15, 2023: Progress discovered a vulnerability (CVE-2023-35708) in MOVEit Transfer that could lead to escalated privileges and potential unauthorized access to the environment. May, 2024: The University System of Georgia (USG) is sending data breach notifications to 800,000 individuals whose data was exposed in the 2023 Clop MOVEit attacks.
arrow_icon
PROTECT

Countermeasures across the security fabric for protecting assets, data and network from cybersecurity events:

Reconnaissance

Lure

Detects attack attempts related to Progress MOVEit Transfer SQL Injection Vulnerability and prevents lateral movement on the network segment

Decoy VM

Detects attack attempts related to Progress MOVEit Transfer SQL Injection Vulnerability and prevents lateral movement on the network segment

Weaponization

Delivery

AV

Detects known malware related to Progress MOVEit Transfer vulnerability campaign

DB 91.03925
DB 91.03925
DB 91.03925
DB 91.03925
DB 91.03925
DB 91.03925
DB 91.03925
DB 91.03925
DB 91.03925
Vulnerability

Detects windows device instances running vulnerable Progress MOVEit application

DB 1.474
AV (Pre-filter)

Detects known malware related to Progress MOVEit Transfer vulnerability campaign

DB 91.03925
DB 91.03925
DB 91.03925
Behavior Detection

Behavior Detection Engine service detects unknown malware related to Progress MOVEit Transfer vulnerability campaign

Exploitation

IPS

Detects and blocks attack attempts leveraging vulnerable MOVEit Transfer Web Application vulnerabilities

DB 23.570
DB 23.570
DB 23.570
DB 23.570
DB 23.570
Web App Security

Detects and blocks attack attempts leveraging vulnerable MOVEit Transfer Web Application vulnerabilities (CVE-2023-34362, CVE-2023-35708, CVE-2023-35036)

DB 0.00350
DB 1.00043
Installation
C2
Action
arrow_icon
DETECT

Find and correlate important information to identify an outbreak, the following updates are available to raise alert and generate reports:

Outbreak Detection

DB 2.00007
DB 316
Threat Hunting
Playbook
arrow_icon
RESPOND

Develop containment techniques to mitigate impacts of security events:

Automated Response

Services that can automaticlly respond to this outbreak.

Assisted Response Services

Experts to assist you with analysis, containment and response activities.

arrow_icon
RECOVER

Improve security posture and processes by implementing security awareness and training, in preparation for (and recovery from) security incidents:

NOC/SOC Training

Train your network and security professionals and optimize your incident response to stay on top of the cyberattacks.

End-User Training

Raise security awareness to your employees that are continuously being targetted by phishing, drive-by download and other forms of cyberattacks.

arrow_icon
IDENTIFY

Identify processes and assets that need protection:

Attack Surface Hardening

Check Security Fabric devices to build actionable configuration recommendations and key indicators.

Vulnerability Management

Reduce the attack surface on software vulnerabilities via systematic and automated patching.

Business Reputation

Know attackers next move to protect against your business branding.