MOVEit Transfer Under Attack: Zero-Day Vulnerability Actively Being Exploited
2.6.23  Vulnerebility  The Hacker News

A critical flaw in Progress Software's in MOVEit Transfer managed file transfer application has come under widespread exploitation in the wild to take over vulnerable systems.

The shortcoming, which is assigned the CVE identifier CVE-2023-34362, relates to a severe SQL injection vulnerability that could lead to escalated privileges and potential unauthorized access to the environment.

"An SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to MOVEit Transfer's database," the company said.

"Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements."

Patches for the bug have been made available by the Massachusetts-based company, which also owns Telerik, in the following versions: 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1).

The development was first reported by Bleeping Computer. According to Huntress and Rapid7, roughly 2,500 instances of MOVEit Transfer were exposed to the public internet as of May 31, 2023, a majority of them located in the U.S.

Successful exploitation attempts culminate in the deployment of a web shell, a file named "human2.aspx" in the "wwwroot" directory that's created via script with a randomized filename, to "exfiltrate various data stored by the local MOVEit service."

The web shell is also engineered to add new admin user account sessions with the name "Health Check Service" in a likely effort to sidestep detection, an analysis of the attack chain has revealed.

Threat intelligence firm GreyNoise said it "observed scanning activity for the login page of MOVEit Transfer located at /human.aspx as early as March 3, 2023," adding five different IP addresses have been detected "attempting to discover the location of MOVEit installations."

"While we don't know the specifics around the group behind the zero day attacks involving MOVEit, it underscores a worrisome trend of threat actors targeting file transfer solutions," Satnam Narang, senior staff research engineer at Tenable, said.

The development has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to issue an alert, urging users and organizations to follow the mitigation steps to secure against any malicious activity.

It's also advised to isolate the servers by blocking inbound and outbound traffic and inspect the environments for possible indicators of compromise (IoCs), and if so, delete them before applying the fixes.
"If it turns out to be a ransomware group again this will be the second enterprise MFT zero day in a year, cl0p went wild with GoAnywhere recently," security researcher Kevin Beaumont said.

MOVEit Transfer Flaw Added to KEV Catalog#
CISA on Friday placed the SQL injection flaw impacting Progress MOVEit Transfer to its Known Exploited Vulnerabilities (KEV) catalog, recommending federal agencies to apply vendor-provided patches by June 23, 2023.

Attack surface management company Censys has discovered over 3,000 exposed hosts utilizing the MOVEit Transfer service, of which more than 60 belong to U.S. federal and state governments.

Mandiant, which is tracking the activity under the uncategorized moniker UNC4857, said the opportunistic attacks have singled out a "wide range of industries" based in Canada, India, the U.S., Italy, Pakistan, and Germany.

The Google Cloud subsidiary said it is "aware of multiple cases where large volumes of files have been stolen from victims' MOVEit transfer systems," adding the web shell (dubbed LEMURLOOT) is also capable of stealing Azure Storage Blob information.

While the exact motivations behind the mass exploitation are currently unknown, it's not uncommon for cybercriminal actors to monetize stolen data via extortion operations or offer it for sale on underground forums.'

It's also the latest effort by threat actors to target enterprise file transfer systems in recent years, which have proven to be a lucrative means to siphon critical data from several victims at once.

"If the goal of this operation is extortion, we anticipate that victim organizations could receive extortion emails in the coming days to weeks," Mandiant researchers said.

(The story has been updated after publication to reflect the CVE identifier and the inclusion of the flaw to the KEV catalog.)