MOVEit Transfer (CVE-2023-34362)
CVE-2023-34362CWE-89OWASP A03:2021CVSS 9.8Updated August 29, 20261 min read
CVE-2023-34362 is a SQL injection in Progress MOVEit Transfer that let an attacker read files and user records without credentials and leave a web shell behind. The Cl0p group exploited it days before any advisory existed, and used it not to encrypt anything but to steal data and extort the organisations it belonged to.
- Affected
- MOVEit Transfer before 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5 and 2023.0.1
- Patched in
- MOVEit Transfer 2023.0.1 and the simultaneous patches for older branches
- Actively exploited
- yes
In late May 2023 the extortion group Cl0p began stealing files at scale from organisations running MOVEit Transfer. The advisory from vendor Progress followed afterwards. What came next was one of the broadest data theft campaigns to date.
What is CVE-2023-34362
MOVEit Transfer is software organisations use to exchange files securely. Its web interface carried a SQL injection: input from an unauthenticated visitor landed straight in a database query. With it an attacker could read the database, forge session tokens and eventually drop a file the server would execute for them.
Why a SQL injection weighed so heavily here
In most applications a SQL injection yields data. Here the database held precisely what the software existed to protect: the references to every file being exchanged. An attacker reading the database was reading the organisation’s entire file exchange.
A second stage sat on top of that. The injection could write a script that the server ran as part of the application, turning the attack into remote code execution.
The chain behind your chain
Organisations that never used MOVEit were hit anyway. Payroll processors, pension administrators and healthcare back offices used it to exchange files with their clients, so the stolen records often belonged to organisations that had never seen the software. That makes this an instructive case in supplier risk as much as in injection.
What to do now
- If you run MOVEit Transfer, verify that every patch since May 2023 is applied and that no unfamiliar files appeared in the web directory during that period.
- Do not put file transfer platforms directly on the internet without reason. An access layer in front of them shrinks the attack surface considerably.
- Ask your suppliers which platforms they use to exchange data with you, and how they patch them.
- Have internet-facing applications tested regularly. An injection like this one is standard ground in a penetration test.
Sources
Frequently asked questions
Why did this one become so notorious?
Not for the technique but for the scale. MOVEit is used to exchange files between organisations, so one compromised server often leaked the records of dozens of that organisation's clients at once.
Was ransomware involved?
Nothing was encrypted. Cl0p only stole data and threatened to publish it. That is now a common model: extortion without the overhead of encryption.
Would patching have prevented it?
Not in the first wave. The attack was already running before Progress published its advisory. Patching quickly did limit the damage of the weeks that followed.
Related articles
- CVEsCWE-119A07:2021Citrix Bleed (CVE-2023-4966)Citrix Bleed explained: how attackers read session tokens out of NetScaler memory, bypassed MFA with them, and why patching alone was not enough.
- GlossaryRansomwareRansomware explained: how this malware encrypts files and systems, how attacks get in, and how to protect your organisation from digital extortion.
- VulnerabilitiesCWE-94A03:2021Remote code execution (RCE)Remote code execution (RCE) explained: how attackers run their own commands or code on your server through unvalidated input, and how to prevent it.
- VulnerabilitiesCWE-89A03:2021SQL injectionSQL injection explained: how attackers use unfiltered input to read or change your database, what the impact is, and how prepared statements stop it.