MOVEit Transfer (CVE-2023-34362)
, 3 min read
CVE-2023-34362 is a SQL injection flaw in Progress Software's MOVEit Transfer, a managed file-transfer server that organisations use to send large or sensitive files to partners. The CL0P ransomware gang exploited it as a zero-day in a mass data-theft campaign. NVD rates it CVSS 3.1 9.8.
The flaw
According to NVD, the web application let an unauthenticated attacker inject SQL into MOVEit's database. Depending on the database engine (MySQL, Microsoft SQL Server or Azure SQL), that could reveal the database's structure and contents and let the attacker change or delete data. No account was needed. The server only had to be reachable from the internet, which is the point of a file-transfer server.
Affected: all MOVEit Transfer versions before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5) and 2023.0.1 (15.0.1).
How CL0P used it
The joint CISA and FBI advisory, AA23-158A, describes the campaign:
- Start. Exploitation began on 27 May 2023, before any patch or public warning.
- Web shell. The attackers installed a web shell CISA calls LEMURLOOT. They named it
human2.aspxto look like one of MOVEit's own files. - Access control. LEMURLOOT only answered requests carrying a hard-coded password in a header, so casual probing didn't reveal it.
- What it did. It could read MOVEit's settings and database, list and download stored files, and create an administrator account. The advisory lists a "Health Check Service" account as one indicator.
The goal was theft, not encryption. CL0P took the data and then contacted victims or listed them on its leak site to demand payment.
Timeline
- 27 May 2023. Exploitation begins.
- 31 May 2023. Progress publishes its advisory and patches.
- 2 June 2023. NVD publishes CVE-2023-34362, and CISA adds it to the Known Exploited Vulnerabilities catalogue.
- 7 June 2023. CISA and the FBI publish AA23-158A.
- 12 and 16 June 2023. Two more SQL injection flaws in the same web application are published: CVE-2023-35036 (CVSS 9.1) and CVE-2023-35708 (CVSS 9.8). Each needed its own patch.
You didn't have to run MOVEit to be breached
The best-known victims never ran MOVEit themselves. Zellis, a UK payroll and HR provider, did. In June 2023, British Airways told its UK and Ireland staff that their payroll data had been exposed through Zellis's MOVEit server. That included names, addresses, dates of birth, National Insurance numbers and bank details. Other Zellis customers reported the same.
That's the real lesson of this campaign. Your exposure includes every vendor that holds your data, and the software each of them runs.
If you run MOVEit Transfer
- Apply the current release. It includes all three June 2023 fixes and any since.
- Look for the indicators in AA23-158A: unexpected
.aspxfiles such ashuman2.aspxin the web root, unknown administrator accounts, and large downloads from the server around and after 27 May 2023. - If you find them, treat everything stored on the server as taken.
What it means for a pipeline and a supplier list
- Parameterised queries, enforced by tooling. SQL injection is a solved problem at the code level. A SAST rule that fails the build on string-built SQL is cheap insurance for your own code.
- Keep internet-facing appliances off the flat network. A file-transfer server holds the data attackers want. Give it its own segment, its own egress rules and its own logging.
- Ask vendors the MOVEit question. For each supplier that holds your data: what software do they use to hold and move it, and how fast do they patch it?
- Minimise what sits at rest. Every file still sitting on a transfer server after delivery is there for whoever breaks in next. A retention rule is a security control.