CVE-2023-34362:

SQL Injection vulnerability in Progress MOVEit Transfer allows unauthenticated attackers to access and manipulate the database.

Score
A numerical rating that indicates how dangerous this vulnerability is.

9.8Critical

Published Date:Jun 2, 2023
CISA KEV Date:Jun 2, 2023
Industries Affected:20

Threat Predictions

EPSS Score:94.3
EPSS Percentile:100%

Exploitability

Score:3.9
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:NONE
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

SQL Injection vulnerability in Progress MOVEit Transfer allows unauthenticated attackers to access and manipulate the database.

Overview

CVE-2023-34362 is a SQL injection vulnerability (CWE-89) affecting Progress MOVEit Transfer web application. The vulnerability impacts all versions before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), including older unsupported versions. This vulnerability is particularly severe as it: 1. Requires no authentication to exploit 2. Provides direct access to the underlying database 3. Allows attackers to potentially view, modify, or delete database content 4. Has been actively exploited in the wild 5. Can be exploited through both encrypted (HTTPS) and unencrypted (HTTP) connections The vulnerability has been associated with widespread attacks against organizations using MOVEit Transfer, resulting in data breaches and system compromises.

Remediation

Organizations using MOVEit Transfer should take the following actions immediately:
1. Update to the patched versions:
Version 2021.0.6 (13.0.6) or later
Version 2021.1.4 (13.1.4) or later
Version 2022.0.4 (14.0.4) or later
Version 2022.1.5 (14.1.5) or later
Version 2023.0.1 (15.0.1) or later
2. If immediate patching is not possible:
Consider temporarily disconnecting MOVEit Transfer from the internet
Implement additional network security controls to restrict access
Monitor systems for indicators of compromise
3. Post-update actions:
Review database logs for suspicious activity
Check for unauthorized user accounts or modifications
Verify data integrity
Consider changing database credentials
4. For systems that may have been compromised:
Conduct a thorough forensic investigation
Restore from known good backups if necessary
Follow breach notification requirements if data exposure occurred