CVE-2023-34362
Progress MOVEit Transfer SQL Injection Vulnerability
Description
CVE-2023-34362 is a critical SQL injection vulnerability in Progress MOVEit Transfer, a widely used managed file transfer solution. This SQL injection flaw in the MOVEit Transfer web application allows an unauthenticated attacker to gain unauthorized access to the application database, enabling them to infer database structure, read sensitive contents, and execute SQL statements that alter or delete data. The vulnerability affects MOVEit Transfer versions before 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, and 2023.0.1, as well as all older unsupported versions including 2020.0 and 2019.x releases. CVE-2023-34362 was actively exploited in the wild during May and June 2023, CISA has added it to the Known Exploited Vulnerabilities catalog, and it has been confirmed as being used in ransomware campaigns. With an EPSS score of 94.3% (99th percentile), this MOVEit Transfer SQL injection vulnerability represents one of the most actively exploited security flaws and demands immediate action.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| progress | moveit cloud | < 14.0.5.45; >= 14.1.0.0, < 14.1.6.97; >= 15.0.0.0, < 15.0.2.39 |
| progress | moveit transfer | < 2021.0.7; >= 2021.1.0, < 2021.1.5; >= 2022.0.0, < 2022.0.5; >= 2022.1.0, < 2022.1.6; >= 2023.0.0, < 2023.0.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/172883/MOVEit-Transfer-SQL-Injection-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/173110/MOVEit-SQL-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-34362(US Government Resource)
Weakness Type
CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
The SQL injection vulnerability in MOVEit Transfer occurs because the web application fails to properly neutralize special characters in user-supplied input before incorporating it into SQL queries. In the context of CVE-2023-34362, an attacker can inject malicious SQL statements through the MOVEit Transfer web interface via HTTP or HTTPS, manipulating database queries to access, modify, or delete data across MySQL, Microsoft SQL Server, or Azure SQL database backends.
Learn more: CWE-89 — Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)
Impact Analysis
CVE-2023-34362 carries a CVSS v3.1 score of 9.8 (Critical), representing the highest severity classification for this MOVEit Transfer SQL injection vulnerability. The vulnerability is remotely exploitable without physical access via HTTP or HTTPS, requires no authentication and no user interaction, and is easy to exploit with no special conditions needed. Confidentiality (High): An attacker can extract sensitive data from the MOVEit Transfer database, including file transfer records, user credentials, organizational data, and any files stored within the managed file transfer system. Integrity (High): The SQL injection allows execution of statements that alter or delete database elements, enabling an attacker to modify transfer records, manipulate user accounts, and tamper with audit logs. Availability (High): Destructive SQL operations can corrupt or delete critical database tables, rendering the MOVEit Transfer service inoperative. With an EPSS score of 94.3% in the 99th percentile indicating near-certain exploitation activity, and the confirmed use in ransomware campaigns, this vulnerability poses an extreme risk to any organization running unpatched MOVEit Transfer instances.
Exploit Maturity
Public exploit code is available for CVE-2023-34362 via Packet Storm Security, and additional proof-of-concept details are available at Packet Storm Security (RCE variant). CISA has confirmed active exploitation in the wild by adding CVE-2023-34362 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 23, 2023, and this vulnerability has been used in ransomware attacks, most notably in mass exploitation campaigns during May and June 2023. The EPSS score of 94.3% (99th percentile) indicates near-certain exploitation activity, making this one of the most actively targeted vulnerabilities. Organizations running any version of MOVEit Transfer should treat this as an emergency requiring immediate patching or service discontinuation.
Remediation
-
Apply Progress patches immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Upgrade MOVEit Transfer to version 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), or 2023.0.1 (15.0.1) or later. Organizations running versions 2020.0, 2019.x, or any other end-of-life release must upgrade to a supported version immediately as no patches are available for these versions.
-
Disable HTTP and HTTPS traffic to the MOVEit Transfer environment as an interim mitigation if patching cannot be completed immediately. This prevents exploitation via the web application while preserving SFTP and FTP/s transfer functionality. Block inbound traffic to ports 80 and 443 on the MOVEit Transfer server.
-
Implement web application firewall (WAF) rules to detect and block SQL injection attempts targeting MOVEit Transfer. Deploy parameterized query detection rules and input validation filters specifically for the MOVEit Transfer web interface endpoints. Restrict access to the MOVEit Transfer web application to known, trusted IP addresses.
-
Conduct a thorough forensic investigation on all MOVEit Transfer instances. Review IIS logs for suspicious HTTP requests, check for unauthorized database modifications, examine the database for new or modified user accounts, and look for evidence of data exfiltration. Given the ransomware association, check for any indicators of ransomware deployment or lateral movement from the MOVEit server.
-
Implement prepared statements and parameterized queries as a long-term defense strategy across all database-interacting components. Enforce least-privilege database access for the MOVEit Transfer application account, removing unnecessary write or administrative permissions. Establish continuous monitoring and alerting for SQL injection patterns in web application traffic.
Technical Details
CVE-2023-34362 is a SQL injection vulnerability (CWE-89) in the Progress MOVEit Transfer web application. The vulnerability arises because user-supplied input is incorporated into SQL queries without proper sanitization or parameterization, allowing an attacker to inject arbitrary SQL statements through HTTP or HTTPS requests. As reflected in the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the attack is network-accessible with low complexity, requires no authentication or user interaction, and fully compromises confidentiality, integrity, and availability. The SQL injection is exploitable against multiple database backends including MySQL, Microsoft SQL Server, and Azure SQL, with the impact varying based on the specific database engine and its permission configuration. The vulnerability was actively exploited in the wild during May and June 2023 via both HTTP and HTTPS protocols, with attackers leveraging the SQL injection to access the MOVEit Transfer database, extract sensitive file transfer data, and in some cases achieve remote code execution by chaining the SQL injection with additional techniques to execute operating system commands on the underlying server.
Frequently Asked Questions
Is CVE-2023-34362 being actively exploited?
Yes, CVE-2023-34362 has been actively and widely exploited in the wild since May 2023. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 23, 2023, and it has been confirmed as being used in ransomware campaigns. The EPSS score of 94.3% (99th percentile) indicates near-certain exploitation activity, making this one of the most actively targeted vulnerabilities.
What products are affected by CVE-2023-34362?
CVE-2023-34362 affects Progress MOVEit Transfer and MOVEit Cloud. Specifically, all versions before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1) are vulnerable. All older unsupported versions, including 2020.0 and 2019.x releases, are also affected.
How do I fix CVE-2023-34362?
Upgrade MOVEit Transfer to one of the patched versions: 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, or 2023.0.1 or later. If immediate patching is not possible, disable HTTP and HTTPS access to the MOVEit Transfer environment as an interim measure. Organizations on end-of-life versions must upgrade to a supported release as no patches are available.
How severe is CVE-2023-34362?
CVE-2023-34362 is rated Critical with a CVSS v3.1 score of 9.8 out of 10. It is in the 99th percentile for exploitation probability with an EPSS score of 94.3%, and has been confirmed in ransomware attacks. The combination of trivial exploitability, maximum impact, and widespread active exploitation makes this one of the most severe vulnerabilities disclosed in 2023.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.