A critical flaw in Progress Softwareβs in MOVEit Transfer managed file transfer application has come under widespread exploitation in the wild to take over vulnerable systems.
The shortcoming, which is assigned the CVE identifier CVE-2023-34362, relates to a severe SQL injection vulnerability that could lead to escalated privileges and potential unauthorized access to the environment.
βAn SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transferβs database,β the company said.
βDepending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.β
Patches for the bug have been made available by the Massachusetts-based company, which also owns Telerik, in the following versions: 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1).
The development was first reported by Bleeping Computer. According to Huntress and Rapid7, roughly 2,500 instances of MOVEit Transfer were exposed to the public internet as of May 31, 2023, a majority of them located in the U.S.
Successful exploitation attempts culminate in the deployment of a web shell, a file named βhuman2.aspxβ in the βwwwrootβ directory thatβs created via script with a randomized filename, to βexfiltrate various data stored by the local MOVEit service.β
The web shell is also engineered to add new admin user account sessions with the name βHealth Check Serviceβ in a likely effort to sidestep detection, an analysis of the attack chain has revealed.
Threat intelligence firm GreyNoise said it βobserved scanning activity for the login page of MOVEit Transfer located at /human.aspx as early as March 3, 2023,β adding five different IP addresses have been detected βattempting to discover the location of MOVEit installations.β
βWhile we donβt know the specifics around the group behind the zero day attacks involving MOVEit, it underscores a worrisome trend of threat actors targeting file transfer solutions,β Satnam Narang, senior staff research engineer at Tenable, said.
The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to issue an alert, urging users and organizations to follow the mitigation steps to secure against any malicious activity.
Itβs also advised to isolate the servers by blocking inbound and outbound traffic and inspect the environments for possible indicators of compromise (IoCs), and if so, delete them before applying the fixes.
UPCOMING WEBINAR
π Mastering API Security: Understanding Your True Attack Surface
Discover the untapped vulnerabilities in your API ecosystem and take proactive steps towards ironclad security. Join our insightful webinar!
βIf it turns out to be a ransomware group again this will be the second enterprise MFT zero day in a year, cl0p went wild with GoAnywhere recently,β security researcher Kevin Beaumont said.
CISA on Friday placed the SQL injection flaw impacting Progress MOVEit Transfer to its Known Exploited Vulnerabilities (KEV) catalog, recommending federal agencies to apply vendor-provided patches by June 23, 2023.
Attack surface management company Censys has discovered over 3,000 exposed hosts utilizing the MOVEit Transfer service, of which more than 60 belong to U.S. federal and state governments.
Mandiant, which is tracking the activity under the uncategorized moniker UNC4857, said the opportunistic attacks have singled out a βwide range of industriesβ based in Canada, India, the U.S., Italy, Pakistan, and Germany.
The Google Cloud subsidiary said it is βaware of multiple cases where large volumes of files have been stolen from victimsβ MOVEit transfer systems,β adding the web shell (dubbed LEMURLOOT) is also capable of stealing Azure Storage Blob information.
While the exact motivations behind the mass exploitation are currently unknown, itβs not uncommon for cybercriminal actors to monetize stolen data via extortion operations or offer it for sale on underground forums.β
Itβs also the latest effort by threat actors to target enterprise file transfer systems in recent years, which have proven to be a lucrative means to siphon critical data from several victims at once.
βIf the goal of this operation is extortion, we anticipate that victim organizations could receive extortion emails in the coming days to weeks,β Mandiant researchers said.
(The story has been updated after publication to reflect the CVE identifier and the inclusion of the flaw to the KEV catalog.)
Found this article interesting? Follow us on Twitter ο and LinkedIn to read more exclusive content we post.