CVE-2023-35708: Progress MOVEit Transfer SQLi Vulnerability

CVE-2023-35708 Overview

CVE-2023-35708 is a SQL injection vulnerability identified in Progress MOVEit Transfer, a widely deployed managed file transfer (MFT) solution used by enterprises and government agencies for secure data exchange. The vulnerability exists in the MOVEit Transfer web application, allowing an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database by submitting a crafted payload to an application endpoint. Successful exploitation could result in modification and disclosure of MOVEit database content.

Critical Impact

An unauthenticated remote attacker can exploit this SQL injection vulnerability to access, modify, or disclose sensitive data stored in the MOVEit Transfer database without any authentication requirements.

Affected Products

• Progress MOVEit Transfer before 2021.0.8 (13.0.8)
• Progress MOVEit Transfer before 2021.1.6 (13.1.6)
• Progress MOVEit Transfer before 2022.0.6 (14.0.6)
• Progress MOVEit Transfer before 2022.1.7 (14.1.7)
• Progress MOVEit Transfer before 2023.0.3 (15.0.3)
• Progress MOVEit Transfer 2020.1.x before 2020.1.10 (12.1.10)

Discovery Timeline

• June 16, 2023 - CVE-2023-35708 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-35708

Vulnerability Analysis

This vulnerability is classified as CWE-89 (SQL Injection), representing improper neutralization of special elements used in SQL commands. The flaw resides in the MOVEit Transfer web application, which fails to properly sanitize user-supplied input before incorporating it into SQL queries executed against the backend database.

The attack can be executed remotely over the network without requiring any authentication or user interaction. An attacker can submit specially crafted payloads to vulnerable application endpoints, allowing them to manipulate SQL queries and gain unauthorized access to database contents. The impact encompasses complete compromise of data confidentiality and integrity within the MOVEit Transfer database.

Root Cause

The root cause of CVE-2023-35708 is insufficient input validation and sanitization in the MOVEit Transfer web application. When processing user-supplied data, the application fails to properly escape or parameterize SQL statements, allowing malicious SQL commands to be injected and executed against the database. This represents a fundamental secure coding failure where untrusted input is directly concatenated into database queries rather than using prepared statements or parameterized queries.

Attack Vector

The attack vector is network-based, requiring the attacker to have network access to the MOVEit Transfer web application. The exploitation process involves:

1. Identifying an exposed MOVEit Transfer instance accessible over the network
2. Crafting a malicious SQL injection payload targeting vulnerable application endpoints
3. Submitting the payload to the web application without authentication
4. Leveraging successful injection to extract, modify, or delete database contents

The vulnerability does not require any form of authentication, making it particularly dangerous for internet-facing MOVEit Transfer deployments. Attackers can potentially access sensitive file transfer metadata, user credentials, and other confidential data stored in the database.

Detection Methods for CVE-2023-35708

Indicators of Compromise

• Unusual database queries or errors in MOVEit Transfer logs, particularly those containing SQL syntax or unexpected characters
• Unexpected data exfiltration or modification patterns in the MOVEit Transfer database
• Anomalous HTTP requests to MOVEit Transfer endpoints containing SQL keywords such as UNION, SELECT, INSERT, or encoded equivalents
• Unauthorized access to sensitive files or data that should be protected by access controls

Detection Strategies

• Deploy Web Application Firewall (WAF) rules specifically designed to detect SQL injection patterns in HTTP requests to MOVEit Transfer
• Implement database activity monitoring to alert on unusual query patterns, failed authentication attempts, or bulk data access
• Review MOVEit Transfer application logs and IIS/web server logs for suspicious request patterns containing SQL injection signatures
• Configure network intrusion detection systems (IDS) with signatures for known MOVEit exploitation attempts

Monitoring Recommendations

• Enable detailed logging for the MOVEit Transfer application and associated database servers
• Monitor for bulk data access or export operations that deviate from normal baseline activity
• Establish alerts for any unauthenticated access attempts to sensitive application endpoints
• Track network connections to MOVEit Transfer from unexpected geographic locations or IP ranges

How to Mitigate CVE-2023-35708

Immediate Actions Required

• Immediately upgrade MOVEit Transfer to a patched version: 2020.1.10 (12.1.10), 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), or 2023.0.3 (15.0.3)
• If immediate patching is not possible, consider temporarily disabling HTTP and HTTPS traffic to the MOVEit Transfer server
• Apply the DLL drop-in fix as provided by Progress Software for environments that cannot perform full upgrades
• Conduct a forensic review of MOVEit Transfer logs and database audit trails to identify any potential compromise

Patch Information

Progress Software has released patched versions addressing this vulnerability. Organizations should apply the appropriate fix based on their current version:

• Version 12.1.x: Upgrade to 2020.1.10 (12.1.10)
• Version 13.0.x: Upgrade to 2021.0.8 (13.0.8)
• Version 13.1.x: Upgrade to 2021.1.6 (13.1.6)
• Version 14.0.x: Upgrade to 2022.0.6 (14.0.6)
• Version 14.1.x: Upgrade to 2022.1.7 (14.1.7)
• Version 15.0.x: Upgrade to 2023.0.3 (15.0.3)

For detailed patch information and download links, refer to the Progress MOVEit Transfer Vulnerability Advisory and the Progress Security Advisory. Additionally, CISA has issued guidance available in the CISA Security Advisory on MOVEit.

Workarounds

• Restrict network access to MOVEit Transfer by implementing strict firewall rules limiting access to trusted IP addresses only
• Disable HTTP/HTTPS traffic to MOVEit Transfer ports (80/443) until patches can be applied
• Place the MOVEit Transfer server behind a VPN or other network access control mechanism to reduce exposure
• Implement a Web Application Firewall (WAF) with SQL injection detection rules as an additional layer of defense

# Example: Block external access to MOVEit Transfer using Windows Firewall
# Run in elevated PowerShell to restrict access to trusted networks only
New-NetFirewallRule -DisplayName "Block External MOVEit Access" -Direction Inbound -Protocol TCP -LocalPort 443 -Action Block -RemoteAddress "!10.0.0.0/8,172.16.0.0/12,192.168.0.0/16"