CVE-2024-5806
CRITICAL EXPLOITEDProgress MOVEit SFTP Authentication Bypass for Arbitrary File Read
Title source: metasploitExploitation Summary
CVE-2024-5806 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 3 public exploits from researchers including watchtowrlabs, sec13b, sfewer-r7, including a Metasploit module auxiliary/gather/progress_moveit_sftp_fileread_cve_2024_5806.
AI-analyzed exploit summary This is a functional exploit for CVE-2024-5806, an authentication bypass vulnerability in Progress MOVEit Transfer. It leverages log poisoning to bypass SFTP authentication and impersonate arbitrary users.
Description
Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.
Exploits (3)
This is a functional exploit for CVE-2024-5806, an authentication bypass vulnerability in Progress MOVEit Transfer. It leverages log poisoning to bypass SFTP authentication and impersonate arbitrary users.
This exploit leverages an authentication bypass vulnerability in Progress MoveIT Transfer by poisoning log files with attacker-controlled SSH public keys, then using Paramiko to authenticate via SFTP. The PoC automates key generation and log poisoning to achieve unauthorized access.
This Metasploit module exploits CVE-2024-5806, an authentication bypass vulnerability in Progress MOVEit Transfer SFTP service, allowing arbitrary file read by manipulating the SSH publickey authentication process.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N