Progress Software Corporation has recently disclosed a critical vulnerability in its MOVEit Transfer web application, urging users to take immediate action to mitigate the risk.

The vulnerability, officially designated as CVE-2023-34362, is an SQL Injection vulnerability that could potentially lead to escalated privileges and unauthorized access. It affects versions prior to 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1) and has already been exploited in the wild in May and June 2023.

All versions of MOVEit Transfer are vulnerable to this exploit. Unpatched systems are particularly susceptible to attacks via HTTP or HTTPS. However, a variety of products are not impacted, including MOVEit Automation, MOVEit Client, MOVEit Add-in for Microsoft Outlook, MOVEit Mobile, WS_FTP Client, WS_FTP Server, MOVEit EZ, MOVEit Gateway, MOVEit Analytics, and MOVEit Freely.

The company advises MOVEit Transfer customers to take immediate action. Although a security patch is in the works, users are encouraged to implement a number of mitigation measures to defend their systems from potential unauthorized access.

These steps include temporarily disabling HTTP and HTTPS traffic, a comprehensive review of the system, deletion of unauthorized files and user accounts, resetting service account credentials for affected systems, application of available security patches, and re-enabling of HTTP and HTTPS traffic. Continuous monitoring, even after these steps are taken, is crucial to ensure the system’s security.

Progress also suggests implementing general security best practices, such as regularly reviewing and removing any unauthorized user accounts, updating network firewall rules, restricting remote access to trusted IP addresses, and enabling multi-factor authentication.

Apply the Patch

Certain potential indicators of compromise have been highlighted by the company. These include unexpected file paths and filenames, unusual HTTP requests, unknown user accounts, unrecognized IPv4 addresses or CIDR, unknown domains, and SHA256 hashes that match those listed in the indicators table.

Indicators of Compromise