CVE-2021-37614: Progress MOVEit Transfer SQLi Vulnerability

CVE-2021-37614 Overview

CVE-2021-37614 is a SQL Injection vulnerability affecting Progress MOVEit Transfer, a widely-used managed file transfer solution. The vulnerability exists in the MOVEit Transfer web application and could allow an authenticated remote attacker to gain unauthorized access to the underlying database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, or execute SQL statements that alter or delete database elements via crafted strings sent to unique MOVEit Transfer transaction types.

Critical Impact

Authenticated attackers can exploit this SQL injection vulnerability to access, modify, or delete sensitive database contents in Progress MOVEit Transfer deployments, potentially compromising the integrity of enterprise file transfer operations.

Affected Products

• Progress MOVEit Transfer versions before 2021.0.3 (13.0.3)
• Progress MOVEit Transfer versions before 2020.1.5 (12.1.5) and 2020.0.6 (12.0.6)
• Progress MOVEit Transfer versions before 2019.2.3 (11.2.3), 2019.1.6 (11.1.6), and 2019.0.7 (11.0.7)

Discovery Timeline

• August 5, 2021 - CVE-2021-37614 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2021-37614

Vulnerability Analysis

This vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The flaw resides in the MOVEit Transfer web application's handling of user-supplied input when processing unique MOVEit Transfer transaction types.

The vulnerability requires authentication, meaning an attacker must first have valid credentials to access the MOVEit Transfer web application. Once authenticated, the attacker can craft malicious strings that are not properly sanitized before being incorporated into SQL queries. This improper input validation allows the attacker to manipulate database queries in unintended ways.

The impact varies based on the underlying database engine. With MySQL, Microsoft SQL Server, or Azure SQL backends, attackers can potentially read sensitive data, infer database structure, modify existing records, or delete database elements entirely. Given that MOVEit Transfer is an enterprise file transfer solution, the database likely contains sensitive metadata about file transfers, user accounts, and organizational data.

Root Cause

The root cause of CVE-2021-37614 is improper input validation and sanitization in the MOVEit Transfer web application. The application fails to adequately neutralize special characters and SQL syntax elements in user-controlled input before incorporating it into database queries. This allows authenticated users to inject arbitrary SQL commands through crafted strings sent to specific MOVEit Transfer transaction types.

The vulnerability demonstrates a classic failure to implement parameterized queries or prepared statements, which would prevent user input from being interpreted as SQL code rather than data.

Attack Vector

The attack is conducted over the network against the MOVEit Transfer web application. An attacker must first authenticate to the application with valid credentials. Once authenticated, the attacker identifies vulnerable transaction types within the application that accept user input. By crafting malicious payloads containing SQL syntax, the attacker can manipulate the backend database queries.

The exploitation process involves sending specially crafted strings to vulnerable MOVEit Transfer transaction endpoints. These malicious inputs bypass input validation and are directly incorporated into SQL queries, allowing the attacker to execute unauthorized database operations. The specific techniques available depend on the database engine in use, but may include UNION-based injection, error-based injection, or blind SQL injection methods.

Detection Methods for CVE-2021-37614

Indicators of Compromise

• Unusual SQL error messages in MOVEit Transfer application logs indicating malformed queries
• Abnormal database query patterns or excessive database errors from the MOVEit Transfer application
• Evidence of data exfiltration or unexpected data modifications in the MOVEit Transfer database
• Web application logs showing suspicious transaction requests with SQL-like syntax in parameters

Detection Strategies

• Deploy Web Application Firewalls (WAF) with SQL injection detection rules to monitor MOVEit Transfer traffic
• Enable and review detailed logging for the MOVEit Transfer web application and underlying database
• Implement database activity monitoring (DAM) solutions to detect anomalous query patterns
• Use Security Information and Event Management (SIEM) tools to correlate authentication events with subsequent suspicious database activity

Monitoring Recommendations

• Monitor MOVEit Transfer access logs for repeated failed or unusual transaction requests
• Configure alerts for database errors that may indicate injection attempts
• Review database audit logs for unauthorized SELECT, UPDATE, INSERT, or DELETE operations
• Track authenticated user sessions for anomalous behavior patterns following login

How to Mitigate CVE-2021-37614

Immediate Actions Required

• Upgrade Progress MOVEit Transfer to a patched version immediately
• Review database logs for evidence of exploitation attempts
• Audit user accounts and permissions to ensure principle of least privilege
• Implement network segmentation to limit access to MOVEit Transfer servers

Patch Information

Progress has released fixed versions addressing this SQL injection vulnerability. Organizations should upgrade to the following versions or later:

• MOVEit Transfer 2021.0.3 (13.0.3)
• MOVEit Transfer 2020.1.5 (12.1.5)
• MOVEit Transfer 2020.0.6 (12.0.6)
• MOVEit Transfer 2019.2.3 (11.2.3)
• MOVEit Transfer 2019.1.6 (11.1.6)
• MOVEit Transfer 2019.0.7 (11.0.7)

Detailed patch information is available through the Progress MOVEit Vulnerability Article and version-specific release notes for MOVEit Transfer 2019, MOVEit Transfer 2020, and MOVEit Transfer 2021.

Workarounds

• Deploy a Web Application Firewall (WAF) with SQL injection protection rules in front of MOVEit Transfer
• Restrict network access to MOVEit Transfer to trusted IP ranges only
• Implement strict input validation at the application layer if possible through custom configurations
• Monitor and limit database privileges used by the MOVEit Transfer application to minimize potential impact

# Example: Restrict network access to MOVEit Transfer using iptables
# Allow only trusted IP ranges to access MOVEit Transfer on port 443
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP