CVE-2024-5806

What it actually does

CVE-2024-5806 is a network-exploitable improper authentication flaw in the Progress MOVEit Transfer SFTP module. An unauthenticated remote attacker can bypass SFTP authentication and gain access as a valid MOVEit user under affected versions. Successful exploitation can allow unauthorized file access, file upload or download, and manipulation of data reachable through the compromised account context. The flaw affects MOVEit Transfer 2023.0.0 through 2023.0.10, 2023.1.0 through 2023.1.5, and 2024.0.0 through 2024.0.1, and is fixed in 2023.0.11, 2023.1.6, and 2024.0.2 respectively.

Why it matters to the business

MOVEit Transfer is commonly used for managed file transfer of sensitive business data, so authentication bypass can result in unauthorized disclosure or tampering of confidential files, regulatory exposure, contractual reporting obligations, and disruption to partner-facing transfer workflows. The CVSS score of 9.1, high EPSS probability, and weaponized exploit maturity indicate a high likelihood of opportunistic scanning and exploitation against internet-exposed systems, even though it is not currently listed in CISA KEV. Organizations using vulnerable versions should treat this as urgent because compromise may directly expose customer, employee, financial, legal, or operational files handled by MOVEit.

How an attack unfolds

An attacker first identifies an internet-accessible MOVEit Transfer server with the SFTP service enabled and fingerprints the product version or behavior. If the server is running an affected release, the attacker sends crafted SFTP authentication traffic that abuses the improper authentication logic to establish a session without possessing valid credentials for the targeted account. Once authenticated, the attacker enumerates accessible folders and files based on the resulting user context, then downloads sensitive data, uploads malicious or unauthorized files, or stages follow-on activity such as persistence through valid account abuse. Because the attack occurs through the SFTP interface, exploitation may not appear as a conventional web attack and should be investigated through SFTP, SSH, application, and file-transfer audit logs.

How to fix it

Upgrade MOVEit Transfer to the fixed release for the deployed branch: upgrade 2023.0.x to 2023.0.11 or later, 2023.1.x to 2023.1.6 or later, and 2024.0.x to 2024.0.2 or later. If immediate upgrade is not possible, disable or restrict the SFTP module, limit SFTP access to trusted source IP ranges through firewall or VPN controls, enforce strong account hygiene, review external user permissions, and monitor for anomalous SFTP activity. After patching, restart MOVEit services as required by vendor guidance and confirm that all load-balanced or standby nodes are also upgraded. Because authentication bypass can enable data access without valid credentials, rotate credentials and keys for high-risk MOVEit users if suspicious activity is found, and review exposed files for potential unauthorized access.

How to confirm the fix worked

Confirm the installed MOVEit Transfer version is no longer in an affected range: 2023.0.11 or later for the 2023.0 branch, 2023.1.6 or later for the 2023.1 branch, and 2024.0.2 or later for the 2024.0 branch. Validate that SFTP is either patched, disabled, or restricted to approved source networks. From an external network perspective, verify whether the SFTP port is reachable and whether the system advertises MOVEit-compatible behavior. Review administrative consoles, installed package records, and service binaries to ensure every MOVEit node has been updated. Run authenticated vulnerability scanning or vendor-provided validation where available, and confirm that no vulnerable instance remains behind a load balancer, NAT rule, disaster recovery host, or temporary migration server.

Typical attack path

1. Scan for MOVEit Transfer instances exposed to the internet, especially systems with SFTP reachable on TCP/22 or a configured alternate SFTP port.
2. Fingerprint MOVEit Transfer version or SFTP behavior to identify releases in the vulnerable 2023.0.x, 2023.1.x, or 2024.0.x ranges.
3. Send crafted SFTP authentication attempts that exploit the improper authentication condition.
4. Establish an unauthorized authenticated SFTP session mapped to a MOVEit user context.
5. Enumerate directories, users, permissions, and available transfer packages or folders allowed to that context.
6. Download sensitive files, upload unauthorized files, or alter files where permissions allow.
7. Clear or minimize traces by limiting failed attempts, using common SSH/SFTP clients, and blending activity into normal managed file-transfer traffic.

How to detect it

Investigate whether exploitation already occurred by reviewing MOVEit Transfer application logs, SFTP/SSH service logs, Windows Event Logs, IIS logs if correlated web access occurred, file-transfer audit logs, administrative audit logs, and network telemetry for SFTP sessions. Focus on successful SFTP authentications from unknown IP addresses, authentications using public-key or unusual methods inconsistent with the account’s normal behavior, successful logins with few or no preceding failures, high-volume downloads, access outside business hours, access from unexpected countries or hosting providers, and activity against dormant or partner accounts. Correlate SFTP login times with file read, download, upload, delete, rename, and permission-change events. Look for newly uploaded files, unexpected automation clients, new or modified SSH keys, account profile changes, and anomalous outbound transfer volume. Because this vulnerability affects authentication logic, absence of password failures does not rule out compromise; prioritize successful session and file-access evidence over failed-login-only detection.

• C:\MOVEitTransfer\Logs\
• C:\Program Files\Progress\MOVEit Transfer\Logs\
• MOVEitTransfer.log
• DMZ_WEB.log
• DMZ_ISAPI.log
• SFTP
• SSH
• publickey
• password
• Authentication successful
• Login successful
• Successful login
• User login
• File downloaded
• File uploaded
• DownloadFile
• UploadFile
• DeleteFile
• RenameFile
• Session started
• Session ended
• TCP/22
• MOVEit Transfer 2023.0.0
• MOVEit Transfer 2023.0.1
• MOVEit Transfer 2023.0.2
• MOVEit Transfer 2023.0.3
• MOVEit Transfer 2023.0.4
• MOVEit Transfer 2023.0.5
• MOVEit Transfer 2023.0.6
• MOVEit Transfer 2023.0.7
• MOVEit Transfer 2023.0.8
• MOVEit Transfer 2023.0.9
• MOVEit Transfer 2023.0.10
• MOVEit Transfer 2023.1.0
• MOVEit Transfer 2023.1.1
• MOVEit Transfer 2023.1.2
• MOVEit Transfer 2023.1.3
• MOVEit Transfer 2023.1.4
• MOVEit Transfer 2023.1.5
• MOVEit Transfer 2024.0.0
• MOVEit Transfer 2024.0.1

What your security team should do

• Immediately inventory all MOVEit Transfer deployments, including externally exposed, internal, test, standby, and disaster recovery systems.
• Prioritize patching internet-facing MOVEit Transfer instances to 2023.0.11, 2023.1.6, 2024.0.2, or later because exploit code is weaponized and EPSS is high.
• Temporarily restrict or disable SFTP access until patching is complete if exposure cannot be remediated quickly.
• Review SFTP authentication logs, file-transfer audit trails, and MOVEit application logs for unauthorized successful logins, unusual source IPs, and abnormal file downloads or uploads since at least the public disclosure date.
• Hunt for access from unfamiliar geographies, hosting providers, VPNs, Tor exit nodes, and source IPs not associated with known partners or automation.
• Audit MOVEit user permissions and remove stale, overprivileged, dormant, or externally accessible accounts.
• If suspicious SFTP activity is identified, preserve logs, identify accessed files, rotate affected credentials and SSH keys, and begin incident response and legal/privacy review as appropriate.
• Add SIEM detections for successful SFTP sessions without expected preceding authentication patterns, unusual session volume, and large data transfers by rarely used accounts.