CVE-2023-35036: Progress MOVEit Transfer SQLi Vulnerability

CVE-2023-35036 Overview

CVE-2023-35036 is a critical SQL injection vulnerability affecting Progress MOVEit Transfer, a widely-used managed file transfer (MFT) solution. The vulnerability exists in the MOVEit Transfer web application and allows unauthenticated attackers to gain unauthorized access to the application's database. By submitting specially crafted payloads to application endpoints, attackers can modify and disclose sensitive database content without requiring any authentication.

Critical Impact

Unauthenticated remote attackers can exploit SQL injection flaws to access, modify, and exfiltrate sensitive data from the MOVEit Transfer database, potentially compromising file transfer operations and confidential information.

Affected Products

• Progress MOVEit Transfer before 2021.0.7 (13.0.7)
• Progress MOVEit Transfer before 2021.1.5 (13.1.5)
• Progress MOVEit Transfer before 2022.0.5 (14.0.5)
• Progress MOVEit Transfer before 2022.1.6 (14.1.6)
• Progress MOVEit Transfer before 2023.0.2 (15.0.2)

Discovery Timeline

• June 12, 2023 - CVE-2023-35036 published to NVD
• January 3, 2025 - Last updated in NVD database

Technical Details for CVE-2023-35036

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) resides within the MOVEit Transfer web application's request handling mechanisms. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, creating an injection point that can be exploited remotely over the network without any authentication requirements.

The vulnerability enables attackers to manipulate database queries by injecting malicious SQL statements through application endpoints. Successful exploitation grants unauthorized read and write access to the MOVEit Transfer database, potentially exposing sensitive file transfer metadata, user credentials, and configuration data. The attack requires no user interaction and can be executed with low complexity.

Root Cause

The root cause of CVE-2023-35036 stems from improper input validation and sanitization in the MOVEit Transfer web application. When processing user requests, the application constructs SQL queries using unvalidated input parameters, allowing attackers to break out of the intended query context and inject arbitrary SQL commands. This failure to implement parameterized queries or adequate input filtering creates a direct path for database manipulation.

Attack Vector

The attack is network-based and targets the MOVEit Transfer web application endpoints. An unauthenticated attacker can craft malicious HTTP requests containing SQL injection payloads directed at vulnerable application parameters. The injected SQL code executes in the context of the database user associated with the MOVEit Transfer application, enabling data exfiltration and modification.

The exploitation flow typically involves:

1. Identifying vulnerable endpoints in the MOVEit Transfer web application
2. Crafting payloads that escape the intended SQL query context
3. Injecting SQL statements to extract database schema information
4. Exfiltrating sensitive data or modifying database content

For technical details regarding this vulnerability, refer to the Progress MOVEit Transfer Vulnerability Advisory.

Detection Methods for CVE-2023-35036

Indicators of Compromise

• Unusual HTTP requests to MOVEit Transfer endpoints containing SQL syntax characters such as single quotes, semicolons, or SQL keywords
• Database query errors or unexpected application behavior following web requests
• Evidence of bulk data extraction or unauthorized database modifications
• Anomalous access patterns to MOVEit Transfer database tables

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block SQL injection attempts targeting MOVEit Transfer
• Monitor web server logs for requests containing common SQL injection patterns and malicious payloads
• Implement database activity monitoring to detect unauthorized queries or data access
• Use SentinelOne Singularity to identify and alert on exploitation attempts and post-exploitation activity

Monitoring Recommendations

• Enable detailed logging on MOVEit Transfer web servers and database components
• Configure alerts for failed authentication attempts and unusual database access patterns
• Monitor network traffic for large data transfers that may indicate exfiltration
• Regularly review database audit logs for unauthorized SELECT, UPDATE, or INSERT operations

How to Mitigate CVE-2023-35036

Immediate Actions Required

• Apply the appropriate security patch from Progress immediately based on your installed version
• Restrict network access to MOVEit Transfer instances to trusted IP addresses where possible
• Enable enhanced logging and monitoring on MOVEit Transfer systems
• Review database access logs for evidence of prior exploitation

Patch Information

Progress Software has released patched versions addressing CVE-2023-35036. Organizations should upgrade to the following minimum versions:

• Version 2021.0.7 (13.0.7) for the 2021.0.x branch
• Version 2021.1.5 (13.1.5) for the 2021.1.x branch
• Version 2022.0.5 (14.0.5) for the 2022.0.x branch
• Version 2022.1.6 (14.1.6) for the 2022.1.x branch
• Version 2023.0.2 (15.0.2) for the 2023.0.x branch

Detailed patch information and download links are available in the Progress MOVEit Transfer Vulnerability Advisory.

Workarounds

• Implement network segmentation to limit exposure of MOVEit Transfer instances
• Deploy a web application firewall (WAF) with SQL injection protection rules in front of MOVEit Transfer
• Temporarily disable public access to the MOVEit Transfer web interface until patches can be applied
• Review and restrict database user permissions to minimize potential impact of exploitation

# Example: Restrict access to MOVEit Transfer at the network level
# Add firewall rules to limit access to trusted IP ranges only
# Windows Firewall example
netsh advfirewall firewall add rule name="Block MOVEit Public Access" dir=in action=block protocol=tcp localport=443
netsh advfirewall firewall add rule name="Allow MOVEit Trusted" dir=in action=allow protocol=tcp localport=443 remoteip=10.0.0.0/8