What We Do
How We Do
Resources
Company
Partners
Get Started
Security advisories

Update on MOVEit Transfer Vulnerabilities

June 20, 2023 | 2 MINS READ

Speak With A Security Expert Now

TALK TO AN EXPERT

THE THREAT

Progress Software has disclosed a third critical vulnerability impacting the MOVEit Transfer application within the past month. The newest MOVEit vulnerability is tracked as CVE-2023-35708; it is a SQL injection vulnerability that would allow a remote and unauthenticated threat actor to gain unauthorized access to MOVEit Transfer's database. At the time of writing, attacks exploiting this vulnerability have not been identified in the wild.

Proof-of-Concept (PoC) exploit code for CVE-2023-35708 was publicly disclosed prior to the release of security patches. Due to the availability of exploit code, the eSentire Threat Intelligence team assesses that it is highly probable that exploitation will occur in the immediate future. Organizations making use of the MOVEit Transfer application need to apply the relevant security patches immediately.

What we're doing about it

What you should do about it

Additional information

The following three vulnerabilities were disclosed by Progress Software in the past month:

CVE-2023-34362 (CVSS: 9.8) was disclosed on May 31st. It is a SQL injection vulnerability that allows unauthenticated threat actors to gain access to MOVEit Transfer's database. Exploitation was confirmed in late May. The CLOP (Lace Tempest) threat actor group exploited this vulnerability to gain initial access into victim organizations and exfiltrate data from impacted systems. The CLOP group is releasing victim data via their leak site. PoC exploit code is publicly available.

CVE-2023-35036 (CVSS: 9.1) was disclosed on June 9th. It is a SQL injection vulnerability that allows unauthenticated threat actors to gain access to MOVEit Transfer's database. There is no indication of attacks in the wild or PoC exploit code at this time.

CVE-2023-35708 (CVSS: NA) was disclosed on June 15th. It is a SQL injection vulnerability that allows unauthenticated threat actors to gain access to MOVEit Transfer's database. Threat actors may submit a crafted payload to a MOVEit Transfer application endpoint which would result in modification or disclosure of MOVEit database content. PoC exploit code was publicly released prior to patch release. While exploitation has not been identified in the wild at this time, exploitation is expected in the near future.

Security patches are now available for all vulnerabilities and all supported MOVEit Transfer versions. Organizations need to review all potentially impacted products and ensure they are up to date with the latest security patches.

References:

[1] https://www.progress.com/security/moveit-transfer-and-moveit-cloud-vulnerability
[2] https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
[3] https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-CVE-2023-35036-June-9-2023
[4] https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023

View Most Recent Advisories