Update on MOVEit Transfer Vulnerabilities

THE THREAT

Progress Software has disclosed a third critical vulnerability impacting the MOVEit Transfer application within the past month. The newest MOVEit vulnerability is tracked as CVE-2023-35708; it is a SQL injection vulnerability that would allow a remote and unauthenticated threat actor to gain unauthorized access to MOVEit Transfer's database. At the time of writing, attacks exploiting this vulnerability have not been identified in the wild.

Proof-of-Concept (PoC) exploit code for CVE-2023-35708 was publicly disclosed prior to the release of security patches. Due to the availability of exploit code, the eSentire Threat Intelligence team assesses that it is highly probable that exploitation will occur in the immediate future. Organizations making use of the MOVEit Transfer application need to apply the relevant security patches immediately.

What we're doing about it

• eSentire Managed Vulnerability Service (MVS) has plugins in place to identify all three recently disclosed MOVEit Transfer vulnerabilities
• eSentire MDR for Network and Endpoint have rules in place to identify CVE-2023-34362 exploitation attempts
• Threat hunts for known Indicators of Compromise (IoCs) associated with real world exploitation of CVE-2023-34362 are ongoing
• The eSentire Threat Intelligence team is actively tracking CVE-2023-35708 and all other recent MOVEit Transfer vulnerabilities for additional details and detection opportunities

What you should do about it

• After performing a business impact review, apply all relevant security patches released by Progress Software
• If patching is not immediately possible, organizations are recommended to isolate MOVEit Transfer until security patches are applied
• Consider restricting access to MOVEit appliances to trusted hosts or networks only
• Avoid use of File Transfer Applications for long-term data storage
  • Remove sensitive files from the application once delivery is complete

Additional information

The following three vulnerabilities were disclosed by Progress Software in the past month:

CVE-2023-34362 (CVSS: 9.8) was disclosed on May 31st. It is a SQL injection vulnerability that allows unauthenticated threat actors to gain access to MOVEit Transfer's database. Exploitation was confirmed in late May. The CLOP (Lace Tempest) threat actor group exploited this vulnerability to gain initial access into victim organizations and exfiltrate data from impacted systems. The CLOP group is releasing victim data via their leak site. PoC exploit code is publicly available.

CVE-2023-35036 (CVSS: 9.1) was disclosed on June 9th. It is a SQL injection vulnerability that allows unauthenticated threat actors to gain access to MOVEit Transfer's database. There is no indication of attacks in the wild or PoC exploit code at this time.

CVE-2023-35708 (CVSS: NA) was disclosed on June 15th. It is a SQL injection vulnerability that allows unauthenticated threat actors to gain access to MOVEit Transfer's database. Threat actors may submit a crafted payload to a MOVEit Transfer application endpoint which would result in modification or disclosure of MOVEit database content. PoC exploit code was publicly released prior to patch release. While exploitation has not been identified in the wild at this time, exploitation is expected in the near future.

Security patches are now available for all vulnerabilities and all supported MOVEit Transfer versions. Organizations need to review all potentially impacted products and ensure they are up to date with the latest security patches.

References:

[1] https://www.progress.com/security/moveit-transfer-and-moveit-cloud-vulnerability
[2] https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
[3] https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-CVE-2023-35036-June-9-2023
[4] https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023