CVE-2023-35036: Progress MOVEit Transfer SQLi Vulnerability

CVE-2023-35036 Overview

CVE-2023-35036 is a critical SQL injection vulnerability affecting Progress MOVEit Transfer, a widely-used managed file transfer (MFT) solution. The vulnerability exists in the MOVEit Transfer web application and allows unauthenticated attackers to gain unauthorized access to the application's database. By submitting specially crafted payloads to application endpoints, attackers can modify and disclose sensitive database content without requiring any authentication.

Critical Impact
Unauthenticated remote attackers can exploit SQL injection flaws to access, modify, and exfiltrate sensitive data from the MOVEit Transfer database, potentially compromising file transfer operations and confidential information.

Affected Products

Progress MOVEit Transfer before 2021.0.7 (13.0.7)
Progress MOVEit Transfer before 2021.1.5 (13.1.5)
Progress MOVEit Transfer before 2022.0.5 (14.0.5)
Progress MOVEit Transfer before 2022.1.6 (14.1.6)
Progress MOVEit Transfer before 2023.0.2 (15.0.2)

Discovery Timeline

June 12, 2023 - CVE-2023-35036 published to NVD
January 3, 2025 - Last updated in NVD database

Technical Details for CVE-2023-35036

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) resides within the MOVEit Transfer web application's request handling mechanisms. The application fails to properly sanitize user-supplied input before incorporating it into SQL queries, creating an injection point that can be exploited remotely over the network without any authentication requirements.

The vulnerability enables attackers to manipulate database queries by injecting malicious SQL statements through application endpoints. Successful exploitation grants unauthorized read and write access to the MOVEit Transfer database, potentially exposing sensitive file transfer metadata, user credentials, and configuration data. The attack requires no user interaction and can be executed with low complexity.

Root Cause

The root cause of CVE-2023-35036 stems from improper input validation and sanitization in the MOVEit Transfer web application. When processing user requests, the application constructs SQL queries using unvalidated input parameters, allowing attackers to break out of the intended query context and inject arbitrary SQL commands. This failure to implement parameterized queries or adequate input filtering creates a direct path for database manipulation.

Attack Vector

The attack is network-based and targets the MOVEit Transfer web application endpoints. An unauthenticated attacker can craft malicious HTTP requests containing SQL injection payloads directed at vulnerable application parameters. The injected SQL code executes in the context of the database user associated with the MOVEit Transfer application, enabling data exfiltration and modification.

The exploitation flow typically involves:

Identifying vulnerable endpoints in the MOVEit Transfer web application
Crafting payloads that escape the intended SQL query context
Injecting SQL statements to extract database schema information
Exfiltrating sensitive data or modifying database content

For technical details regarding this vulnerability, refer to the Progress MOVEit Transfer Vulnerability Advisory.

Detection Methods for CVE-2023-35036

Indicators of Compromise

Unusual HTTP requests to MOVEit Transfer endpoints containing SQL syntax characters such as single quotes, semicolons, or SQL keywords
Database query errors or unexpected application behavior following web requests
Evidence of bulk data extraction or unauthorized database modifications
Anomalous access patterns to MOVEit Transfer database tables

Detection Strategies

Deploy web application firewall (WAF) rules to detect and block SQL injection attempts targeting MOVEit Transfer
Monitor web server logs for requests containing common SQL injection patterns and malicious payloads
Implement database activity monitoring to detect unauthorized queries or data access
Use SentinelOne Singularity to identify and alert on exploitation attempts and post-exploitation activity

Monitoring Recommendations

Enable detailed logging on MOVEit Transfer web servers and database components
Configure alerts for failed authentication attempts and unusual database access patterns
Monitor network traffic for large data transfers that may indicate exfiltration
Regularly review database audit logs for unauthorized SELECT, UPDATE, or INSERT operations

How to Mitigate CVE-2023-35036

Immediate Actions Required

Apply the appropriate security patch from Progress immediately based on your installed version
Restrict network access to MOVEit Transfer instances to trusted IP addresses where possible
Enable enhanced logging and monitoring on MOVEit Transfer systems
Review database access logs for evidence of prior exploitation

Patch Information

Progress Software has released patched versions addressing CVE-2023-35036. Organizations should upgrade to the following minimum versions:

Version 2021.0.7 (13.0.7) for the 2021.0.x branch
Version 2021.1.5 (13.1.5) for the 2021.1.x branch
Version 2022.0.5 (14.0.5) for the 2022.0.x branch
Version 2022.1.6 (14.1.6) for the 2022.1.x branch
Version 2023.0.2 (15.0.2) for the 2023.0.x branch

Detailed patch information and download links are available in the Progress MOVEit Transfer Vulnerability Advisory.

Workarounds

Implement network segmentation to limit exposure of MOVEit Transfer instances
Deploy a web application firewall (WAF) with SQL injection protection rules in front of MOVEit Transfer
Temporarily disable public access to the MOVEit Transfer web interface until patches can be applied
Review and restrict database user permissions to minimize potential impact of exploitation

bash

# Example: Restrict access to MOVEit Transfer at the network level
# Add firewall rules to limit access to trusted IP ranges only
# Windows Firewall example
netsh advfirewall firewall add rule name="Block MOVEit Public Access" dir=in action=block protocol=tcp localport=443
netsh advfirewall firewall add rule name="Allow MOVEit Trusted" dir=in action=allow protocol=tcp localport=443 remoteip=10.0.0.0/8