Cybersecurity companies and researchers are sounding the alarm on a new zero-day vulnerability in Progress Software’s MOVEit Transfer solution, with attackers pouncing on the vulnerability since it was disclosed by Progress Software on May 31.
According to Progress Software, the vulnerability in MOVEit Transfer could lead to escalated privileges and potential unauthorized access to the environment. MOVEit Transfer customers are advised to take immediate action to help protect their environment. Organizations are urged to apply the patch immediately.
Affecting all supported MOVEit Transfer versions, the bug is an SQL injection vulnerability that could allow an unauthenticated attacker to gain access to MOVEit Transfer’s database.
“Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements,” the company says.
Defending against the MOVEit zero-day vulnerability
To prevent exploitation of the vulnerability, organizations are urged to disable all HTTP and HTTPs traffic to their MOVEit environment, delete unauthorized files and user accounts, reset credentials, and apply a patch. Customers on unsupported versions should upgrade to a supported version, Progress Software says.
After applying the patch, organizations should enabled HTTP and HTTPs traffic, ensure that no unauthorized accounts remain, and continue to monitor the network, endpoints and logs for indicators of compromise. Organizations should look for indicators of compromise dating back at least a month.
Read the company’s advisory for additional security best practices to help defend against exploitation of this vulnerability, which as of Friday, has no CVE assigned.
According to cybersecurity firm Rapid7, there were roughly 2,5000 instances of MOVEit Transfers exposed to the public internet as of May 31, with the majority located in the U.S. Similar SQLi-to-RCE flaws in network edge systems can provide threat actors with initial access to corporate networks, the company says.
Rapid7 says its researchers observed the same webshell name in multiple customer environments, which could be an indicator of automated exploitation.
Rapid7 analyzed a sample webshell payload associated with successful exploitation. The webshell code would first determine if the inbound request contained a header named X-siLock-Comment, and would return a 404 “Not Found” error if the header was not populated with a specific password-like value. As of June 1, 2023, all instances of Rapid7-observed MOVEit Transfer exploitation involve the presence of the file human2.aspx in the wwwroot folder of the MOVEit install directory (human.aspx is the native aspx file used by MOVEit for the web interface).
Ransomware groups leveraging file transfer solutions
The vulnerability in MOVEit Transfer is the latest case of cybercriminals targeting file transfer tools, specifically with ransomware groups who are moving away from encryption and focusing solely on data theft to compel their victims to pay the ransom.
Satnam Narang, senior staff research engineer at Tenable, says file transfer applications have become increasingly popular among ransomware groups since late 2020. One group in particular, Clop, has breached “hundreds of organizations: that use those tools to transfer sensitive data.
“While we don’t know the specifics around the group behind the zero day attacks involving MOVEit, it underscores a worrisome trend of threat actors targeting file transfer solutions,” Narang says. “Organizations that use MOVEit software should assume compromise and engage in incident response to determine the potential impact, if any.”
If you enjoyed this article and want to receive more valuable industry content like this, click here to sign up for our digital newsletters!
