CVE-2023-36934

What it actually does

This is an unauthenticated SQL injection flaw in the Progress MOVEit Transfer web application. A remote attacker can send crafted HTTP requests to vulnerable MOVEit application endpoints that cause attacker-controlled input to be interpreted as SQL by the backend database. Successful exploitation can allow unauthorized database access, including disclosure of stored MOVEit data and modification of database records. The CVSS 9.1 rating reflects network reachability, no required credentials, no user interaction, and high confidentiality and integrity impact. Although the supplied package metadata references golang/go and a Go commit, the vulnerability description and affected version ranges correspond to Progress MOVEit Transfer; asset and SBOM mappings should be validated for that inconsistency.

Why it matters to the business

MOVEit Transfer is commonly used to exchange sensitive files with partners, customers, and internal teams, so compromise can lead directly to exposure or tampering of regulated data, customer records, business documents, credentials, file-transfer metadata, and audit trails. Because exploitation is unauthenticated, weaponized, and has a very high EPSS probability, internet-facing MOVEit systems should be treated as high-priority remediation targets even though this CVE is not currently listed in CISA KEV and is not specifically marked as ransomware-associated. Operational consequences may include emergency shutdown of file-transfer services, partner notification, legal and regulatory reporting, forensic investigation, credential rotation, and loss of trust in managed file-exchange workflows.

How an attack unfolds

An attacker first identifies an exposed MOVEit Transfer web application and determines whether it is running a vulnerable release. The attacker then sends specially crafted HTTP requests to a vulnerable application endpoint with input designed to alter backend SQL query logic. If the application passes that input unsafely to the database, the attacker can query data that should not be accessible, enumerate schema or user information, extract file-transfer metadata or sensitive records, and potentially modify database content. In a broader intrusion, the attacker may use database access to obtain account data, session-related information, application configuration, file references, or other material useful for follow-on access, data theft, persistence, or tampering with audit records. Given the weaponized exploit maturity and high EPSS score, attempts may be automated and may appear as probing followed by rapid data enumeration or unusual database activity originating from the web application tier.

How to fix it

Upgrade Progress MOVEit Transfer to a fixed version or later: 2020.1.11 / 12.1.11, 2021.0.9 / 13.0.9, 2021.1.7 / 13.1.7, 2022.0.7 / 14.0.7, 2022.1.8 / 14.1.8, or 2023.0.4 / 15.0.4. If your dependency or asset inventory shows golang/go as the affected component with fixed commit 68f9a6e2addc828246992e66e79c6a51a32d1d71, validate the mapping against vendor advisories because the CVE description is for MOVEit Transfer rather than the Go project. Until patched, restrict public access to MOVEit Transfer to trusted networks or VPN, place it behind a WAF with SQL injection protections, disable or limit nonessential external endpoints, enforce strong database least privilege for the application account, and monitor for abnormal database queries. After patching, rotate MOVEit application secrets, database credentials, API keys, service account credentials, and any credentials or tokens that may have been stored in or accessible through the application. If compromise is suspected, preserve logs and disk evidence before rebuilding or restoring systems.

How to confirm the fix worked

Confirm the installed MOVEit Transfer version is at or above the fixed release for its branch by checking the application UI, installed package/version metadata, file version information, and vendor patch history. Verify that all internet-facing and internally exposed MOVEit nodes, including standby, disaster recovery, test, and partner-facing instances, have been upgraded. Run authenticated vulnerability scans or configuration checks that specifically identify MOVEit Transfer version and patch level; do not rely only on generic web fingerprinting. Review WAF, reverse proxy, IIS/web server, application, and database logs for attempted SQL injection before and after the patch. Confirm that temporary mitigations, such as IP allowlisting or WAF rules, are still effective where needed. Validate that database accounts used by MOVEit have only required privileges and that no unexpected database users, application users, scheduled tasks, web files, or configuration changes were introduced during the exposure window.

Typical attack path

1. Scan the internet or target ranges for exposed Progress MOVEit Transfer web interfaces.
2. Fingerprint the application version or behavior to identify potentially vulnerable releases before 2020.1.11, 2021.0.9, 2021.1.7, 2022.0.7, 2022.1.8, or 2023.0.4.
3. Send crafted unauthenticated HTTP requests containing SQL-control syntax or encoded SQL injection payloads to MOVEit Transfer application endpoints.
4. Use database error responses, timing behavior, or response differences to confirm injectable parameters.
5. Enumerate database structure, users, sessions, configuration, file-transfer metadata, or stored sensitive records.
6. Exfiltrate data from the MOVEit database or modify records to support further access or concealment.
7. Attempt follow-on actions such as credential abuse, creation or manipulation of transfer records, access to stored files, or deletion/tampering of logs and audit data.

How to detect it

Investigate possible prior exploitation by correlating web access logs, WAF/reverse-proxy logs, MOVEit Transfer application logs, Windows Event Logs, database audit logs, and file-transfer/audit records for the period when the system was running a vulnerable version. In IIS or proxy logs, look for unauthenticated requests to MOVEit endpoints containing SQL metacharacters, URL-encoded quotes, UNION/SELECT syntax, comment markers, stacked-query separators, timing functions, or database error probing. In application logs, look for database exceptions, authentication anomalies, failed request bursts, unexpected session creation, abnormal admin actions, or audit-log gaps. In database logs, look for queries issued by the MOVEit application account that enumerate system tables, access unusually broad tables, use suspicious SQL constructs, return unusually large result sets, or occur at unusual times. Review file-transfer records for unexpected bulk downloads, access to many organizations or folders by a single source, unexplained file deletions, and metadata changes. Also inspect the MOVEit web directory and scheduled-task/service configuration for unexpected files or persistence artifacts, while recognizing that webshell artifacts publicly associated with earlier MOVEit exploitation campaigns are not specific proof of this CVE unless supported by timeline and log evidence.

• UNION SELECT
• UNION%20SELECT
• UNION+SELECT
• WAITFOR DELAY
• WAITFOR%20DELAY
• SLEEP(
• BENCHMARK(
• @@version
• information_schema
• sysobjects
• syscolumns
• xp_cmdshell
• ' OR '1'='1
• %27%20OR%20%271%27%3D%271
• ' OR 1=1--
• %27%20OR%201%3D1--
• ;SELECT
• %3BSELECT
• --
• /*
• */
• ODBC SQL Server Driver
• SQL syntax
• Unclosed quotation mark after the character string
• Incorrect syntax near
• Conversion failed when converting
• System.Data.SqlClient.SqlException
• Microsoft.Data.SqlClient.SqlException
• MOVEit.DMZ
• C:\MOVEitTransfer\wwwroot\
• C:\Program Files\MOVEit\Transfer\wwwroot\

What your security team should do

• Immediately inventory all MOVEit Transfer deployments, prioritizing internet-facing systems and any systems used for third-party file exchange.
• Patch or upgrade all affected MOVEit Transfer versions to the appropriate fixed release or later; treat the issue as urgent because exploitation is weaponized and EPSS is very high.
• If immediate patching is not possible, restrict access to trusted source IPs or VPN and deploy WAF rules that block SQL injection patterns against MOVEit endpoints.
• Perform a compromise assessment for the full exposure period, including web logs, application logs, database audit logs, file-transfer activity, and administrative account activity.
• Look for abnormal database reads, large exports, unexpected file-transfer metadata access, account/session anomalies, and evidence of log tampering.
• Rotate MOVEit database credentials, application secrets, API keys, admin passwords, and credentials for accounts that interacted with the platform if exploitation cannot be ruled out.
• Review MOVEit users, API users, SSH keys, certificates, automation accounts, and partner access for unauthorized additions or changes.
• Preserve forensic evidence before rebuilding systems where exploitation is suspected, including web roots, logs, database backups, configuration files, and memory/disk images where feasible.
• Add SIEM detections for SQL injection probes and unusual MOVEit database access patterns, and tune alerting for high-volume downloads or atypical partner activity.
• Validate asset-management and SBOM data because the supplied affected-product metadata appears inconsistent with the MOVEit Transfer vulnerability description.