CVE-2023-35708

CRITICALRansomwareNuclei

Progress MOVEit Transfer Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2023-35708 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template. VulnCheck reports CVE-2023-35708 use in known ransomware campaigns.

Description

In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content. These are fixed versions of the DLL drop-in: 2020.1.10 (12.1.10), 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3).

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Aug 30, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck
Ransomware use
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 17, 2024 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

MOVEit Transfer

Browse Progress / MOVEit Transfer
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALMOVEit Transfer - SQL InjectionCVSS 9.1

In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content. These are fixed versions of the DLL drop-in: 2020.1.10 (12.1.10), 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3).

Impact

Attackers can modify and disclose sensitive database content, leading to data breach and potential system compromise.

Remediation

Update to fixed versions: 2020.1.10, 2021.0.8, 2021.1.6, 2022.0.6, 2022.1.7, or latest available version.

WeaknessesCWE-89
Authorsdaffainfo, jjcho
Template tagscvecve2023moveitsqliprogressvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CPE: cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*
Shodan: http.favicon.hash:989289239
FOFA: icon_hash=989289239
https://x.com/wvuuuuuuuuuuuuu/status/1679969146635710469 https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023 https://www.progress.com/security/moveit-transfer-and-moveit-cloud-vulnerability https://nvd.nist.gov/vuln/detail/CVE-2023-35708

Source: ProjectDiscovery

References

4