CVE-2023-34362

What it actually does

CVE-2023-34362 is an unauthenticated SQL injection vulnerability in the Progress MOVEit Transfer web application. A remote attacker can send crafted HTTP or HTTPS requests to the MOVEit Transfer application and cause backend SQL queries to execute attacker-controlled input. Depending on the database backend, including MySQL, Microsoft SQL Server, or Azure SQL, exploitation can allow database reconnaissance, extraction of sensitive records, creation or modification of application data, deletion of database elements, and installation of follow-on webshell malware. Because the flaw requires no authentication, no user interaction, and is remotely reachable over the network, successful exploitation can lead to full compromise of sensitive file-transfer data handled by the application.

Why it matters to the business

This vulnerability has severe business impact because MOVEit Transfer commonly stores or brokers sensitive files exchanged with customers, vendors, employees, and partners. Confirmed exploitation in the wild began in May and June 2023, it is listed in CISA KEV, has been associated with ransomware/data-extortion activity, and had a CISA remediation deadline of 2023-06-23. Organizations running exposed or historically exposed MOVEit Transfer or MOVEit Cloud instances may face theft of regulated data, contractual notification obligations, operational disruption to managed file transfer workflows, incident response costs, legal exposure, and reputational harm. The very high EPSS score indicates broad attacker interest and a high likelihood of exploitation against unpatched internet-facing systems.

How an attack unfolds

An attacker first identifies an internet-facing MOVEit Transfer web application. They send specially crafted unauthenticated requests over HTTP or HTTPS to vulnerable MOVEit endpoints, causing attacker-controlled SQL to be evaluated by the backend database. The attacker uses the SQL injection to enumerate database structure and retrieve data related to users, organizations, file metadata, session or authentication material, and stored transfer content. In observed campaigns, attackers used the database access to stage additional actions, including writing or triggering a webshell such as LEMURLOOT through files like human2.aspx, then issued commands to list folders, enumerate users, and exfiltrate files. Follow-on activity may include deleting artifacts, maintaining access through webshell requests, and using stolen data for extortion. Exploitation has been widely associated with mass data-theft operations targeting MOVEit Transfer deployments.

How to fix it

Immediately upgrade MOVEit Transfer to a fixed release or later. The fixed versions identified by Progress are 2021.0.6 / 13.0.6, 2021.1.4 / 13.1.4, 2022.0.4 / 14.0.4, 2022.1.5 / 14.1.5, and 2023.0.1 / 15.0.1. All older and unsupported versions, including 2020.0 and 2019.x, should be considered affected and should be upgraded to a supported fixed release. If immediate patching is not possible, remove MOVEit Transfer from internet exposure, block HTTP and HTTPS access to the MOVEit web application except from trusted administrative networks, and follow vendor emergency mitigation guidance. After patching, perform incident response rather than treating the upgrade as sufficient, because exploitation was active before public disclosure. Rotate credentials, API keys, database credentials, service account passwords, and any secrets that may have been stored in or accessible through MOVEit. Review and remove unauthorized files, webshells, accounts, sessions, and database changes. For MOVEit Cloud, confirm the provider-applied remediation status and obtain available investigation artifacts from Progress support.

How to confirm the fix worked

Confirm the running MOVEit Transfer version is at or above the applicable fixed release: 13.0.6, 13.1.4, 14.0.4, 14.1.5, or 15.0.1. Verify the web application is not running an older unsupported branch. Confirm public HTTP/HTTPS exposure is restricted according to business need and compensating controls are in place. Review the MOVEit installation webroot for unauthorized ASPX files, especially human2.aspx or similarly named files. Search web server, MOVEit, Windows, and database logs for suspicious unauthenticated requests, SQL errors, webshell access, unusual file enumeration, unexpected large downloads, and requests containing LEMURLOOT-associated headers. Validate that database integrity checks show no unauthorized accounts, modified settings, rogue sessions, or suspicious application records. Run vendor-provided or trusted detection scripts where available, but do not rely on a clean script result alone if the system was internet-facing during May or June 2023 or before patching.

Typical attack path

1. Identify an exposed Progress MOVEit Transfer or MOVEit Cloud web interface reachable over HTTP or HTTPS.
2. Send crafted unauthenticated requests to vulnerable MOVEit application endpoints to trigger SQL injection.
3. Enumerate the backend database engine and schema to locate sensitive MOVEit application tables and records.
4. Extract user, organization, file-transfer, session, and configuration data from the database.
5. Use database access to alter application state or enable follow-on access, including deployment of a webshell where possible.
6. Interact with the webshell or abused application functions to enumerate files and prepare data for theft.
7. Exfiltrate sensitive files and database contents from the MOVEit environment.
8. Attempt to remove traces such as webshell files, suspicious database artifacts, and request history, then use stolen data for extortion.

How to detect it

Investigate historical exposure, especially activity from May 2023 onward and any period before patching. Review IIS web server logs for unauthenticated requests to MOVEit endpoints followed by unusual responses, access to suspicious ASPX files, or repeated requests to human2.aspx. Search for LEMURLOOT webshell behavior, including custom HTTP headers such as X-siLock-Comment, X-siLock-Step1, X-siLock-Step2, and X-siLock-Step3. Inspect the MOVEit Transfer webroot and subdirectories for unexpected ASPX files, unusual timestamps, recently modified files, or files owned by unexpected accounts. Review MOVEit application logs for unexpected administrative actions, session creation, file listing, file downloads, user enumeration, organization enumeration, and abnormal transfer volume. Review database logs for suspicious SQL errors, unusual queries, schema enumeration, unauthorized updates, or access patterns inconsistent with normal application behavior. Review Windows Event Logs for web server worker process anomalies, script execution, file creation, or suspicious child processes spawned by IIS. Check network telemetry and proxy logs for large outbound transfers from MOVEit servers, especially to unfamiliar destinations. If compromise is suspected, preserve logs and disk artifacts before removing webshells or upgrading, because attackers may delete evidence after exploitation.

• human2.aspx
• _human2.aspx
• /human2.aspx
• /_human2.aspx
• C:\\MOVEitTransfer\\wwwroot\\human2.aspx
• C:\\MOVEitTransfer\\wwwroot\\_human2.aspx
• C:\\MOVEitTransfer\\wwwroot\\moveitisapi\\human2.aspx
• X-siLock-Comment
• X-siLock-Step1
• X-siLock-Step2
• X-siLock-Step3
• X-siLocked
• LEMURLOOT
• moveitisapi.dll?action=m2
• /moveitisapi/moveitisapi.dll?action=m2
• /guestaccess.aspx
• /api/v1/folders
• /api/v1/files

What your security team should do

• Treat any MOVEit Transfer instance exposed before remediation as potentially compromised and initiate incident response immediately.
• Upgrade all MOVEit Transfer deployments to a fixed supported version or later: 13.0.6, 13.1.4, 14.0.4, 14.1.5, 15.0.1, or newer supported releases.
• If patch status is uncertain, temporarily disable external HTTP/HTTPS access to the MOVEit web application until validation is complete.
• Hunt for LEMURLOOT and related webshell artifacts, especially human2.aspx and suspicious ASPX files in the MOVEit webroot.
• Collect and preserve IIS logs, MOVEit application logs, Windows event logs, database logs, webroot file timestamps, and forensic images before cleanup where feasible.
• Search for evidence of unauthorized file enumeration, bulk downloads, abnormal session creation, database manipulation, and outbound data transfer.
• Rotate MOVEit application secrets, database credentials, service account passwords, API keys, and credentials for users or integrations that may have been exposed.
• Review data handled by MOVEit during the exposure window and prepare legal, privacy, customer, and partner notification workflows if sensitive data may have been accessed.
• Add SIEM detections for known webshell paths, LEMURLOOT headers, suspicious MOVEit endpoint access, and anomalous large downloads from MOVEit servers.
• Because this vulnerability is in CISA KEV, associated with ransomware/data-extortion activity, and has a very high EPSS score, prioritize remediation and historical compromise assessment ahead of routine vulnerability backlog items.