MOVEit Transfer Under Attack: Zero-Day Vulnerability Actively Being Exploited

A critical flaw in Progress Software’s in MOVEit Transfer managed file transfer application has come under widespread exploitation in the wild to take over vulnerable systems.

The shortcoming, which is yet to be assigned a CVE identifier, relates to a severe SQL injection vulnerability that could lead to escalated privileges and potential unauthorized access to the environment.

“An SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer’s database,” the company said.

“Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements.”

Patches for the bug have been made available by the Massachusetts-based company, which also owns Telerik, in the following versions: 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1).

The development was first reported by Bleeping Computer. According to Huntress and Rapid7, roughly 2,500 instances of MOVEit Transfer were exposed to the public internet as of May 31, 2023, a majority of them located in the U.S.

Successful exploitation attempts culminate in the deployment of a web shell, a file named “human2.aspx” in the “wwwroot” directory that’s created via script with a randomized filename, to “exfiltrate various data stored by the local MOVEit service.”

The web shell is also engineered to add new admin user account sessions with the name “Health Check Service” in a likely effort to sidestep detection, an analysis of the attack chain has revealed.

Threat intelligence firm GreyNoise said it “observed scanning activity for the login page of MOVEit Transfer located at /human.aspx as early as March 3, 2023,” adding five different IP addresses have been detected “attempting to discover the location of MOVEit installations.”

UPCOMING WEBINAR

🔐 Mastering API Security: Understanding Your True Attack Surface

Discover the untapped vulnerabilities in your API ecosystem and take proactive steps towards ironclad security. Join our insightful webinar!

Join the Session

“While we don’t know the specifics around the group behind the zero day attacks involving MOVEit, it underscores a worrisome trend of threat actors targeting file transfer solutions,” Satnam Narang, senior staff research engineer at Tenable, said.

The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to issue an alert, urging users and organizations to follow the mitigation steps to secure against any malicious activity.

It’s also advised to isolate the servers by blocking inbound and outbound traffic and inspect the environments for possible indicators of compromise (IoCs), and if so, delete them before applying the fixes.

“If it turns out to be a ransomware group again this will be the second enterprise MFT zero day in a year, cl0p went wild with GoAnywhere recently,” security researcher Kevin Beaumont said.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.