--- key: "case-study-moveit" title: "Case study: MOVEit Transfer mass exploitation (CVE-2023-34362)" url: "https://softwaresecurity.com/domains/appsec/vulnerability-response/case-study-moveit/" api: "https://softwaresecurity.com/api/v1/articles/case-study-moveit.json" domain: "appsec" topic: "Application security" type: "Case study" identifiers: ["CWE-89","A05:2025","CAPEC-66"] tags: ["Injection","Incident response","Vulnerability management","Supplier and open source risk"] stages: ["respond","govern"] roles: ["developer","appsec-engineer"] license: "CC-BY-4.0" license_url: "https://creativecommons.org/licenses/by/4.0/" code_license: "MIT" --- # Case study: MOVEit Transfer mass exploitation (CVE-2023-34362) How one unauthenticated SQL injection in an internet-facing file transfer product let the Cl0p group steal data from thousands of organizations in days in 2023, how defenders found the web shell, and the vendor and customer controls that would have limited it. Canonical URL: https://softwaresecurity.com/domains/appsec/vulnerability-response/case-study-moveit/ ## In short From 2023-05-27 the Cl0p extortion group used an unauthenticated SQL injection in Progress MOVEit Transfer (CVE-2023-34362) to install a web shell, LEMURLOOT, and steal the files the product stored for its customers. Progress disclosed and patched it on 2023-05-31; CISA added it to KEV on 2023-06-02. Emsisoft counted 2,773 affected organizations and about 95.8 million people by June 2024. Parameterized queries on the vendor side, and less internet exposure, fast KEV-driven patching, short retention and web-shell monitoring on the customer side, were the controls that mattered. - One SQL injection in a public endpoint was enough: no credentials, no phishing, no user action. - Exploitation started on 2023-05-27, a US holiday weekend, four days before Progress's advisory; the patch did not undo theft that had already happened. - The web shell was named `human2.aspx` to look like the product's `human.aspx`, answered only requests with a secret `X-siLock-Comment` header, and created a 'Health Check Service' account. - Code review after the first fix found more SQL injection flaws: CVE-2023-35036 on 2023-06-09 and CVE-2023-35708 on 2023-06-15. - Cl0p stole and extorted; it did not encrypt. Data that had been deleted after transfer could not be stolen. - Cl0p had used the same playbook against Accellion FTA in 2020 and 2021: file transfer appliances are a repeated target. ## Incident at a glance - Date: 2023-05-27 - Category: Vulnerability exploitation - Organizations: Progress Software (MOVEit Transfer); Cl0p extortion group (claimed responsibility) - CVE: [CVE-2023-34362](https://nvd.nist.gov/vuln/detail/cve-2023-34362), [CVE-2023-35036](https://nvd.nist.gov/vuln/detail/cve-2023-35036), [CVE-2023-35708](https://nvd.nist.gov/vuln/detail/cve-2023-35708) - Impact: An unauthenticated SQL injection let attackers plant the LEMURLOOT web shell and download the files that internet-facing MOVEit Transfer servers held. Emsisoft counted 2,773 affected organizations and about 95.8 million people by June 2024. - How it was found: Defenders found it by its traces: an unexpected `human2.aspx` in the web root, a new administrator account named Health Check Service and large outbound transfers. ### Timeline 1. 2021-07: Kroll later reports IIS log evidence of similar activity at some clients from July 2021. 2. 2022-04: Kroll reports apparent data-collection testing from April 2022. 3. 2023-05-27: Mass exploitation begins over the US Memorial Day weekend. 4. 2023-05-31: Progress discloses the flaw, releases fixed versions and advises blocking HTTP and HTTPS traffic to MOVEit Transfer. 5. 2023-06-02: CVE-2023-34362 is published, CISA adds it to KEV, and Mandiant publishes its LEMURLOOT analysis. 6. 2023-06-06: Cl0p claims responsibility on its leak site. 7. 2023-06-07: CISA and the FBI publish joint advisory AA23-158A. 8. 2023-06-09: Progress fixes further SQL injection flaws found in code review, CVE-2023-35036. 9. 2023-06-15: Progress discloses and fixes another SQL injection, CVE-2023-35708. 10. 2024-06-28: Emsisoft’s count reaches 2,773 organizations and about 95.8 million people. ## Recommended defaults | Setting | Value | Note | Source | | --- | --- | --- | --- | | CVE-2023-34362 | Unauthenticated SQL injection, CVSS 3.1 9.8 (CISA ADP) | Fixed in 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5 and 2023.0.1; all earlier versions affected, including unsupported ones. | CVE record | | CISA KEV | Added 2023-06-02; known ransomware campaign use | CVE-2023-35036 and CVE-2023-35708 are not in KEV. | CISA KEV catalog | | Follow-on fixes | CVE-2023-35036 (2023-06-09) and CVE-2023-35708 (2023-06-15) | Later fixed versions include 2023.0.2 and 2023.0.3; take the newest release, which includes all three fixes. | Progress advisories, via Unit 42; CVE records | | Web shell | LEMURLOOT, `human2.aspx` (also `_human2.aspx`) | Authenticates with the `X-siLock-Comment` header; creates or reuses a 'Health Check Service' account. | CISA AA23-158A; Mandiant | | Scale (estimate) | 2,773 organizations; 95,788,491 individuals | Emsisoft, as of 2024-06-28, from public disclosures; individuals may be counted more than once. | Emsisoft | | If you ran an unpatched, exposed instance | Assume compromise: hunt, contain, then patch and rotate | Patching alone does not remove a web shell or recover stolen data. | CISA AA23-158A | ## Verify it 1. List every internet-facing third-party application that stores sensitive data, with its version, owner and patch path. 2. Confirm that a new KEV entry for any of them reaches an owner and a patch or mitigation within days. 3. On file transfer systems, check the retention setting and delete files once their transfer is complete. 4. Monitor web roots of third-party applications for new or changed script files, and alert on them. 5. For code you write, confirm every query that touches request data is parameterized, and that SAST or code review flags string-built SQL. ## What you will learn - Trace the attack from an unauthenticated SQL injection to a web shell and bulk data theft. - Hunt a server for the published indicators and judge what missing logs mean. - Separate vendor-side and customer-side controls, mapped to SSDF practices. - Plan a response to a vendor zero-day that patches, hunts, rotates and notifies in the right order. Audience: Application security engineers, and IT and security teams who run internet-facing vendor products such as file transfer, VPN and email gateways Before you start: - Know what SQL injection is and how parameterized queries prevent it. - Know how IIS logs record requests and where a web application's files live. - For the code: PowerShell on Windows, and C# reading knowledge. Time: About 26 minutes: 6 to read and 20 for the exercise ## One SQL injection, thousands of victims MOVEit Transfer is a managed file transfer product: organizations run it, usually on the internet, so partners and customers can exchange files. It therefore holds a lot of other people's sensitive data. In late May 2023 an extortion group known as Cl0p found and used an unauthenticated SQL injection in its web application, CVE-2023-34362, to plant a web shell and download the stored files from every vulnerable server it could reach. The attack was not a software supply-chain compromise in the build sense: nobody tampered with Progress's code. It was a supply-chain incident in the business sense: a single flaw in a widely used vendor product exposed thousands of organizations, and the people whose data those organizations held, at once. That makes it the counterpart to /domains/appsec/vulnerability-response/case-study-log4shell/, where the flaw sat in a library inside many products. ## Timeline | When | Event | Source | | --- | --- | --- | | July 2021 to April 2022 | Kroll reports IIS log evidence of similar activity at some clients as early as July 2021, and data-collection testing from April 2022. | Kroll, via BleepingComputer | | 2023-05-27 | Mass exploitation begins, over the US Memorial Day weekend; in some cases data is stolen within minutes of the web shell being installed. | CISA AA23-158A; Mandiant | | 2023-05-31 | Progress discloses the vulnerability and releases fixed versions, with interim advice to block HTTP and HTTPS traffic to MOVEit Transfer. | Progress; Mandiant | | 2023-06-02 | CVE-2023-34362 is published and CISA adds it to KEV; Mandiant publishes its analysis of the LEMURLOOT web shell. | CVE record; CISA KEV; Mandiant | | 2023-06-06 | Cl0p claims responsibility on its leak site and tells victims to contact it. | Mandiant | | 2023-06-07 | CISA and the FBI publish joint advisory AA23-158A with indicators. | CISA AA23-158A | | 2023-06-09 | Progress fixes further SQL injection flaws found in code review (CVE-2023-35036). | Progress, via Unit 42; CVE record | | 2023-06-15 | Another SQL injection, CVE-2023-35708, is disclosed and fixed. | Progress, via Unit 42; CVE record | | 2024-06-28 | Emsisoft's running count reaches 2,773 organizations and about 95.8 million individuals. | Emsisoft | ## How did the attack work? - Injection: Mandiant saw POST requests to the legitimate `guestaccess.aspx` before web shell activity, consistent with SQL injection through that page; the CVE describes unauthenticated access to the database over HTTP or HTTPS. - Persistence: the attackers installed LEMURLOOT, a C# web shell named `human2.aspx` to resemble the product's `human.aspx`. It returned 404 unless a request carried the right secret in an `X-siLock-Comment` header. - Access: the shell created or reused an administrator account called 'Health Check Service', listed files, folders and owners, and returned the Azure Blob Storage settings for instances that stored files there. - Theft: it downloaded files by ID, compressed; scanning came from one network range and theft from separate second-stage hosts. - Extortion: Cl0p published victim names and threatened to leak data; it did not deploy ransomware encryption, so operations kept running while data walked out. ## The weakness: SQL built from request data SQL injection (CWE-89) is a solved problem in principle: send values as parameters and the database never parses them as SQL. It persists because large, older codebases still build some queries by concatenation, often in code paths that predate current review practices, such as guest or anonymous access pages. Progress fixed three distinct SQL injection CVEs in three weeks, which suggests the first was not an isolated mistake but a pattern that a focused review found more of. The C# below illustrates the weakness and its fix; it is not MOVEit's code. /domains/appsec/secure-coding/sql-injection-python-sqlite3/ and /domains/appsec/secure-coding/injection-parser-boundaries/ cover the defense in depth, including how to find remaining concatenated queries with code search and SAST. ```csharp // Illustration of the weakness class, not MOVEit's code. using Microsoft.Data.SqlClient; using System.Data; static class Users { // Vulnerable: the input becomes part of the SQL text, so a value such as // x' OR '1'='1 changes the query. Any unauthenticated endpoint that does this // hands the database to the caller. public static SqlCommand FindVulnerable(SqlConnection conn, string username) => new SqlCommand("SELECT Id, RealName FROM users WHERE LoginName = '" + username + "'", conn); // Fixed: the value travels as a typed parameter and is never parsed as SQL. public static SqlCommand Find(SqlConnection conn, string username) { var cmd = new SqlCommand("SELECT Id, RealName FROM users WHERE LoginName = @login", conn); cmd.Parameters.Add("@login", SqlDbType.NVarChar, 256).Value = username; return cmd; } } ``` ## How was it found, and what should you hunt for? Customers and incident responders found it by its traces: unexpected `.aspx` files in the MOVEit web root, unusual requests in IIS logs, a new administrator account and large outbound transfers. Progress's advisory, Mandiant's analysis and the joint CISA and FBI advisory then published the indicators. Because exploitation started before disclosure, every exposed, unpatched instance needed a hunt, not just a patch. The script below covers the main checks on a Windows MOVEit server: unexpected script files in the web root, IIS log entries for the web shell names and for POSTs to `guestaccess.aspx`, and the 'Health Check Service' account in the database. A match means the server was compromised; an empty result is meaningful only if the logs cover the whole window. ```powershell # Run on the MOVEit Transfer web server. Adjust $wwwroot to your installation. $wwwroot = 'C:\MOVEitTransfer\wwwroot' # 1. ASPX files that are not part of the product, newest first (LEMURLOOT posed as human2.aspx) Get-ChildItem $wwwroot -Filter *.aspx -Recurse | Sort-Object LastWriteTime -Descending | Select-Object FullName, LastWriteTime -First 20 Get-ChildItem $wwwroot -Recurse -Include 'human2.aspx', '_human2.aspx' -ErrorAction SilentlyContinue # 2. IIS logs: requests to the web shell names, and POSTs to guestaccess.aspx, # which Mandiant saw before web shell use. Review the whole window, from May 2023. Select-String -Path 'C:\inetpub\logs\LogFiles\W3SVC*\*.log' ` -Pattern 'human2\.aspx', 'POST /guestaccess\.aspx' | Select-Object -First 50 Filename, LineNumber, Line # 3. The account the web shell created, in the MOVEit database (read-only query): # SELECT LoginName, RealName FROM users WHERE RealName = 'Health Check Service'; ``` ## Which controls would have stopped or limited it? | Control | Who | SSDF practice or standard | Guide | | --- | --- | --- | --- | | Parameterized queries everywhere; SAST and review for string-built SQL | Vendor | SSDF PW.5, PW.7, PW.8 | /domains/appsec/secure-coding/injection-parser-boundaries/ | | Find variants after a fix (the June CVEs) | Vendor | SSDF RV.3 (root-cause analysis) | /domains/appsec/vulnerability-response/coordinated-disclosure/ | | Minimize internet exposure: VPN, IP allow-lists or a gateway for partners | Customer | Attack-surface reduction | /frameworks/supplier-software-assurance/ | | Patch KEV entries on internet-facing systems within days | Customer | CISA BOD 26-04 deadlines; SSVC | /frameworks/vulnerability-prioritization/ | | Delete files after transfer; short retention | Customer | Data minimization | /domains/identity-crypto/privacy/data-minimization-retention/ | | Monitor web roots, admin accounts and outbound volume; keep IIS logs | Customer | OWASP A09:2025 logging and alerting | /domains/runtime/detection/security-event-logging/ | | An incident runbook for a vendor zero-day: contain, hunt, patch, rotate, notify | Customer | SSDF RV.2 | /domains/appsec/vulnerability-response/dependency-vulnerability-response/ | ## Lessons that still apply - Internet-facing systems that aggregate other people's data are prime targets for mass exploitation; reduce what they expose and what they keep. - A zero-day exploited over a holiday weekend is a planning assumption, not bad luck: have an owner and a containment step ready for each such system. - Patch, then hunt: a fix stops new exploitation but does nothing about web shells and data already taken. - Expect follow-on CVEs after a critical fix in the same code, and keep watching the vendor advisory. - The same group had done this to Accellion FTA in 2020 and 2021; a repeat pattern is a reason to rank similar products higher. ## What the public evidence does not establish The public record does not establish how Cl0p found the vulnerability or whether the 2021 and 2022 activity Kroll saw used the same flaw. Victim counts come from public notifications and the group's own claims, so they are estimates that overlap and may undercount. Mandiant's merge of the activity into FIN11 and the group's claim of responsibility are attribution, separate from the technical evidence of the exploit and web shell. ## Guided practice It is 2023-06-02. You manage four MOVEit Transfer deployments. Decide each one's status and actions. Treat the facts as true. ### Supplied material ```text M1: Version 2022.1.4, internet-facing on 443; IIS logs retained 90 days; logs show POST /guestaccess.aspx and GET /human2.aspx from unfamiliar IPs on 2023-05-28; a 'Health Check Service' account exists; files are kept for 365 days. M2: Version 2023.0.0, internet-facing; HTTP and HTTPS blocked at the firewall on 2023-05-31 18:00 UTC per Progress's interim advice; IIS logs show no requests to human2.aspx; no unexpected accounts. M3: Version 2022.1.4, reachable only over the partner VPN; IIS logging disabled. M4: Inventory record says version 2023.0.1, installed 2023-05-26; internet-facing; no indicators found. ``` ### 1. Decide M1 What is M1's status and response order? Worked answer: Compromised: the web shell requests and the 'Health Check Service' account match the published indicators. Contain (take it offline), preserve logs and the web root, remove the shell and the account, patch to a fixed release, rotate service credentials and any Azure storage keys, determine which files were taken, and start breach notification. A 365-day retention means a year of partner files was exposed. ### 2. Decide M2 Is M2 safe? Worked answer: Exposed from 2023-05-27 until the block on 2023-05-31, but with no indicators in the logs. Patch to 2023.0.1 or later, keep hunting with the full indicator set, and rotate credentials as a precaution; it is lower priority than M1, not cleared. ### 3. Decide M3 What does missing logging mean for M3? Worked answer: It runs a vulnerable version, and the VPN reduces but does not remove exposure, since any partner network on the VPN can reach it. Without IIS logs you cannot rule out compromise: check the web root and database for the indicators, patch, enable logging, and treat file contents as possibly exposed if indicators appear. ### 4. Check M4's record Can you trust M4's inventory record? Worked answer: 2023.0.1 was released on 2023-05-31, so it cannot have been installed on 2023-05-26. The inventory is wrong: verify the actual version and install date on the server before trusting any status, then treat M4 as exposed until proven otherwise. ### 5. Change the defaults Name three changes for the next vendor zero-day. Worked answer: Put file transfer behind a VPN or allow-list where partners allow it; delete files after transfer with short retention; and keep IIS and application logs centrally for at least a year with alerts on new script files in the web root and new admin accounts, so the next hunt has evidence. Deliverable: A status table for M1 to M4 (compromised, exposed or unknown; evidence; actions in order) and three standing changes. Scope: The deployments are invented; the versions, dates and indicators are from Progress, CISA and Mandiant. Real investigations used more indicators than the few shown here, and missing logs leave the question open rather than answering it. Articles and teaching material: CC BY 4.0. Original executable code: MIT. Attribution: Software Security. ## Sources - [CISA and FBI AA23-158A: CL0P ransomware gang exploits CVE-2023-34362 MOVEit vulnerability](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a). 7 June 2023. - [Mandiant: Zero-day vulnerability in MOVEit Transfer exploited for data theft](https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft). 2 June 2023. - [Progress: MOVEit Transfer critical vulnerability (May 2023)](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023) - [CVE-2023-34362 record](https://www.cve.org/CVERecord?id=CVE-2023-34362) - [CVE-2023-35036 record](https://www.cve.org/CVERecord?id=CVE-2023-35036) - [CVE-2023-35708 record](https://www.cve.org/CVERecord?id=CVE-2023-35708) - [CISA: CISA Adds One Known Exploited Vulnerability to Catalog (CVE-2023-34362)](https://www.cisa.gov/news-events/alerts/2023/06/02/cisa-adds-one-known-exploited-vulnerability-catalog). 2 June 2023. - [Emsisoft: Unpacking the MOVEit breach, statistics and analysis](https://www.emsisoft.com/en/blog/44123/unpacking-the-moveit-breach-statistics-and-analysis/). Updated 28 June 2024. - [BleepingComputer: Clop ransomware likely testing MOVEit zero-day since 2021 (Kroll findings)](https://www.bleepingcomputer.com/news/security/clop-ransomware-likely-testing-moveit-zero-day-since-2021/). 8 June 2023. - [Unit 42: Threat Brief, MOVEit Transfer SQL injection vulnerabilities (CVE-2023-34362, CVE-2023-35036, CVE-2023-35708)](https://unit42.paloaltonetworks.com/threat-brief-moveit-cve-2023-34362/)