⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2023-06-23.

CVE-2023-34362 — MOVEit: SQL Injection in Progress MOVEit Transfer

CWE-89 — SQL Injection42 documents18 sources
Severity
9.8CRITICALNVD
EPSS
94.3%
top 0.07%
CISA KEV
KEVRansomware
Added 2023-06-02
Due 2023-06-23
Exploit
Exploited in wild
Active exploitation observed
Affected products
11
Progress Moveit CloudProgress Moveit TransferPaloalto Cortex Data+8 more
Timeline
PublishedJun 2
KEV addedJun 2
KEV dueJun 23
Latest updateJan 7
CISA Required Action: Apply updates per vendor instructions.

Description

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and exe…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages11 packages

▶NVDprogress/moveit_transfer2021.1.0 — 2021.1.5+4
▶NVDprogress/moveit_cloud14.1.0.0 — 14.1.6.97+2
▶Palo Altopaloalto/pan-os
▶Palo Altopaloalto/prisma_sd

🔴Vulnerability Details

3
GHSA
GHSA-hq22-q5g8-577g: In Progress MOVEit Transfer before 2021↗2023-06-02
▶
CVEList
CVE-2023-34362: In Progress MOVEit Transfer before 2021↗2023-06-02
▶
VulnCheck
Progress MOVEit Transfer SQL Injection Vulnerability↗2023
▶

💥Exploits & PoCs

1
Nuclei
MOVEit Transfer - Remote Code Execution
▶

🔍Detection Rules

14
Suricata
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Trigger SQL Injection via guestaccess.aspx - CVE-2023-34362 Stage 2↗2023-06-12
▶
Suricata
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Successful Folder Request - CVE-2023-34362 Stage 4↗2023-06-12
▶
Suricata
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Set Session Variables - SQLi Payload Creation - CVE-2023-34362 Stage 5a↗2023-06-12
▶
Suricata
ET WEB_SPECIFIC_APPS MOVEit File Transfer - Payload Trigger Request - CVE-2023-34362 Stage 5b↗2023-06-12
▶
Suricata
ET WEB_SPECIFIC_APPS MOVEit File Transfer - CSRF Token Request on guestaccess.aspx - CVE-2023-34362 Stage 1b↗2023-06-12
▶

📋Vendor Advisories

2
Palo Alto
PAN-SA-2023-0003 Informational Bulletin: Impact of MOVEit Vulnerabilities (CVE-2023-34362, CVE-2023-35036, CVE-2023-35708)↗2023-06-16
▶
CISA
Progress MOVEit Transfer SQL Injection Vulnerability↗2023-06-02
▶

🕵️Threat Intelligence

16
Sentinelone
MOVEit Transfer Vulnerability used to Drop File-Stealing SQL Shell↗2024-01-07
▶
Bleepingcomputer
Delta Dental of California data breach exposed info of 7 million people↗2023-12-15
▶
Unit42
Threat Brief - MOVEit Transfer SQL Injection Vulnerabilities: CVE-2023-34362, CVE-2023-35036 and CVE-2023-35708 (Updated Oct 4)↗2023-10-04
▶
Unit42
Threat Brief - MOVEit Transfer SQL Injection Vulnerabilities: CVE-2023-34362, CVE-2023-35036 and CVE-2023-35708 (Updated Oct 4)↗2023-10-04
▶
Bleepingcomputer
Sony confirms data breach impacting thousands in the U.S.↗2023-10-04
▶
CVE-2023-34362 — MOVEit: SQL Injection in Progress | cvebase