Case study: MOVEit Transfer mass exploitation (CVE-2023-34362)

MOVEit Transfer is a managed file transfer product: organizations run it, usually on the internet, so partners and customers can exchange files. It therefore holds a lot of other people's sensitive data. In late May 2023 an extortion group known as Cl0p found and used an unauthenticated SQL injection in its web application, CVE-2023-34362, to plant a web shell and download the stored files from every vulnerable server it could reach.

The attack was not a software supply-chain compromise in the build sense: nobody tampered with Progress's code. It was a supply-chain incident in the business sense: a single flaw in a widely used vendor product exposed thousands of organizations, and the people whose data those organizations held, at once. That makes it the counterpart to /domains/appsec/vulnerability-response/case-study-log4shell/, where the flaw sat in a library inside many products.

• Injection: Mandiant saw POST requests to the legitimate guestaccess.aspx before web shell activity, consistent with SQL injection through that page; the CVE describes unauthenticated access to the database over HTTP or HTTPS.
• Persistence: the attackers installed LEMURLOOT, a C# web shell named human2.aspx to resemble the product's human.aspx. It returned 404 unless a request carried the right secret in an X-siLock-Comment header.
• Access: the shell created or reused an administrator account called 'Health Check Service', listed files, folders and owners, and returned the Azure Blob Storage settings for instances that stored files there.
• Theft: it downloaded files by ID, compressed; scanning came from one network range and theft from separate second-stage hosts.
• Extortion: Cl0p published victim names and threatened to leak data; it did not deploy ransomware encryption, so operations kept running while data walked out.

SQL injection (CWE-89) is a solved problem in principle: send values as parameters and the database never parses them as SQL. It persists because large, older codebases still build some queries by concatenation, often in code paths that predate current review practices, such as guest or anonymous access pages. Progress fixed three distinct SQL injection CVEs in three weeks, which suggests the first was not an isolated mistake but a pattern that a focused review found more of.

The C# below illustrates the weakness and its fix; it is not MOVEit's code. /domains/appsec/secure-coding/sql-injection-python-sqlite3/ and /domains/appsec/secure-coding/injection-parser-boundaries/ cover the defense in depth, including how to find remaining concatenated queries with code search and SAST.

// Illustration of the weakness class, not MOVEit's code.
using Microsoft.Data.SqlClient;
using System.Data;

static class Users
{
    // Vulnerable: the input becomes part of the SQL text, so a value such as
    // x' OR '1'='1 changes the query. Any unauthenticated endpoint that does this
    // hands the database to the caller.
    public static SqlCommand FindVulnerable(SqlConnection conn, string username) =>
        new SqlCommand("SELECT Id, RealName FROM users WHERE LoginName = '" + username + "'", conn);

    // Fixed: the value travels as a typed parameter and is never parsed as SQL.
    public static SqlCommand Find(SqlConnection conn, string username)
    {
        var cmd = new SqlCommand("SELECT Id, RealName FROM users WHERE LoginName = @login", conn);
        cmd.Parameters.Add("@login", SqlDbType.NVarChar, 256).Value = username;
        return cmd;
    }
}

Customers and incident responders found it by its traces: unexpected .aspx files in the MOVEit web root, unusual requests in IIS logs, a new administrator account and large outbound transfers. Progress's advisory, Mandiant's analysis and the joint CISA and FBI advisory then published the indicators. Because exploitation started before disclosure, every exposed, unpatched instance needed a hunt, not just a patch.

The script below covers the main checks on a Windows MOVEit server: unexpected script files in the web root, IIS log entries for the web shell names and for POSTs to guestaccess.aspx, and the 'Health Check Service' account in the database. A match means the server was compromised; an empty result is meaningful only if the logs cover the whole window.

# Run on the MOVEit Transfer web server. Adjust $wwwroot to your installation.
$wwwroot = 'C:\MOVEitTransfer\wwwroot'

# 1. ASPX files that are not part of the product, newest first (LEMURLOOT posed as human2.aspx)
Get-ChildItem $wwwroot -Filter *.aspx -Recurse |
  Sort-Object LastWriteTime -Descending |
  Select-Object FullName, LastWriteTime -First 20
Get-ChildItem $wwwroot -Recurse -Include 'human2.aspx', '_human2.aspx' -ErrorAction SilentlyContinue

# 2. IIS logs: requests to the web shell names, and POSTs to guestaccess.aspx,
#    which Mandiant saw before web shell use. Review the whole window, from May 2023.
Select-String -Path 'C:\inetpub\logs\LogFiles\W3SVC*\*.log' `
  -Pattern 'human2\.aspx', 'POST /guestaccess\.aspx' |
  Select-Object -First 50 Filename, LineNumber, Line

# 3. The account the web shell created, in the MOVEit database (read-only query):
#    SELECT LoginName, RealName FROM users WHERE RealName = 'Health Check Service';

• Internet-facing systems that aggregate other people's data are prime targets for mass exploitation; reduce what they expose and what they keep.
• A zero-day exploited over a holiday weekend is a planning assumption, not bad luck: have an owner and a containment step ready for each such system.
• Patch, then hunt: a fix stops new exploitation but does nothing about web shells and data already taken.
• Expect follow-on CVEs after a critical fix in the same code, and keep watching the vendor advisory.
• The same group had done this to Accellion FTA in 2020 and 2021; a repeat pattern is a reason to rank similar products higher.

The public record does not establish how Cl0p found the vulnerability or whether the 2021 and 2022 activity Kroll saw used the same flaw. Victim counts come from public notifications and the group's own claims, so they are estimates that overlap and may undercount. Mandiant's merge of the activity into FIN11 and the group's claim of responsibility are attribution, separate from the technical evidence of the exploit and web shell.

Sources & further reading

The standards, specifications and documentation behind the guidance above. Each is the evidence for a claim on this page; consult it for detail beyond the defaults and versions listed here.

1. CISA and FBI AA23-158A: CL0P ransomware gang exploits CVE-2023-34362 MOVEit vulnerability. 7 June 2023.
2. Mandiant: Zero-day vulnerability in MOVEit Transfer exploited for data theft. 2 June 2023.
3. Progress: MOVEit Transfer critical vulnerability (May 2023)
4. CVE-2023-34362 record
5. CVE-2023-35036 record
6. CVE-2023-35708 record
7. CISA: CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2023-34362). 2 June 2023.
8. Emsisoft: Unpacking the MOVEit breach, statistics and analysis. Updated 28 June 2024.
9. BleepingComputer: Clop ransomware likely testing MOVEit zero-day since 2021 (Kroll findings). 8 June 2023.
10. Unit 42: Threat Brief, MOVEit Transfer SQL injection vulnerabilities (CVE-2023-34362, CVE-2023-35036, CVE-2023-35708)

Reference information

Tags

InjectionIncident responseVulnerability managementSupplier and open source risk

SDLC phase

MaintenanceSecurity program

Role

DevelopersAppSec engineers

CAPEC attack patterns

• CAPEC-66 at MITRE

Download this guide as Markdown

Continue exploring