CVE-2023-34362criticalunder attackransomwareCWE-89

CVE-2023-34362

Published · Updated

Follow this CVE+ Monitor MOVEit Transfer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon4 days
Published on NVDJun 2
1st PoC+4d
metasploitMay 31
CISA KEVJun 2
victimsAug 21
Appeared in 2 incident(s) we investigated
The Hospital for Sick Children (SickKids) · Shell, General Electric (GE) e Philips
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

Ransomwareclop Vexday
Action required by CISAfederal deadline: 2023-06-23

Apply updates per vendor instructions.

In short

MOVEit Transfer has a SQL injection flaw that lets attackers without login credentials access and manipulate the database. This is a critical issue because attackers can steal sensitive data or destroy information stored in the system.

Technical detail

Unauthenticated SQL injection vulnerability in MOVEit Transfer web application allows attackers to execute arbitrary SQL queries against the backend database (MySQL, MSSQL, or Azure SQL) via HTTP/HTTPS requests. Attackers can enumerate database structure, extract sensitive information, or modify/delete database contents; exploitation has been observed in production environments since May 2023.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.