CVE-2023-36932: Progress MOVEit Transfer SQLi Vulnerability

CVE-2023-36932 Overview

CVE-2023-36932 identifies multiple SQL injection vulnerabilities in Progress MOVEit Transfer, a widely-used managed file transfer (MFT) solution deployed by organizations for secure data exchange. These vulnerabilities exist in the MOVEit Transfer web application and could allow an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

Critical Impact

Authenticated attackers can exploit SQL injection flaws to read, modify, or exfiltrate sensitive data stored in the MOVEit Transfer database, potentially compromising confidential business files and credentials.

Affected Products

• Progress MOVEit Transfer before 2020.1.11 (12.1.11)
• Progress MOVEit Transfer before 2021.0.9 (13.0.9)
• Progress MOVEit Transfer before 2021.1.7 (13.1.7)
• Progress MOVEit Transfer before 2022.0.7 (14.0.7)
• Progress MOVEit Transfer before 2022.1.8 (14.1.8)
• Progress MOVEit Transfer before 2023.0.4 (15.0.4)

Discovery Timeline

• 2023-07-05 - CVE-2023-36932 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-36932

Vulnerability Analysis

This vulnerability falls under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), commonly known as SQL Injection. The MOVEit Transfer web application contains multiple endpoints that fail to properly sanitize user-supplied input before incorporating it into SQL queries executed against the backend database.

When an authenticated user submits specially crafted input to vulnerable application endpoints, the malicious payload is processed without adequate validation or parameterization. This allows the attacker's SQL commands to be executed directly against the MOVEit Transfer database, bypassing intended access controls.

The attack requires network access and valid authentication credentials, which slightly limits the attack surface. However, once authenticated, an attacker can leverage these SQL injection points to extract sensitive database content, modify records, or potentially escalate their access within the system.

Root Cause

The root cause stems from improper input validation and the failure to use parameterized queries or prepared statements in the MOVEit Transfer web application. User-supplied input from web endpoints is concatenated directly into SQL query strings without proper sanitization or escaping of special SQL characters. This architectural flaw allows attackers to break out of the intended query context and inject arbitrary SQL commands.

Attack Vector

The attack is conducted over the network against the MOVEit Transfer web interface. An attacker must first obtain valid credentials to authenticate to the application—this could be through compromised accounts, credential theft, or insider access. Once authenticated, the attacker identifies vulnerable endpoints that accept user input and submits crafted payloads containing SQL syntax designed to manipulate the underlying database queries.

The exploitation involves injecting SQL metacharacters and commands through application input fields, URL parameters, or API requests. The injected SQL can perform operations such as extracting database schema information, dumping table contents, modifying or deleting records, or potentially executing stored procedures depending on database configuration and permissions.

Detection Methods for CVE-2023-36932

Indicators of Compromise

• Unusual SQL error messages appearing in MOVEit Transfer application logs
• Database query logs showing unexpected UNION SELECT, OR 1=1, or other SQL injection patterns
• Abnormal database read operations or data exports from authenticated sessions
• Suspicious login activity followed by unusual data access patterns

Detection Strategies

• Monitor web application firewall (WAF) logs for SQL injection attack signatures targeting MOVEit Transfer endpoints
• Implement database activity monitoring to detect anomalous query patterns from the application service account
• Review MOVEit Transfer access logs for unusual endpoint requests with encoded or malformed parameters
• Deploy intrusion detection rules to identify common SQL injection payloads in HTTP traffic

Monitoring Recommendations

• Enable detailed logging on the MOVEit Transfer application and configure centralized log aggregation
• Implement real-time alerting for database errors and unusual query execution times
• Monitor for bulk data retrieval operations that deviate from normal user behavior patterns
• Track authentication events and correlate with subsequent database activity for anomaly detection

How to Mitigate CVE-2023-36932

Immediate Actions Required

• Upgrade MOVEit Transfer to the latest patched version immediately: 2020.1.11, 2021.0.9, 2021.1.7, 2022.0.7, 2022.1.8, or 2023.0.4 or later
• Review and audit user accounts with access to MOVEit Transfer and disable any unnecessary or suspicious accounts
• Enable web application firewall rules to filter SQL injection attack patterns
• Restrict network access to MOVEit Transfer to only authorized IP ranges where possible

Patch Information

Progress Software has released security patches addressing these SQL injection vulnerabilities across all affected version branches. Organizations should apply the appropriate service pack for their installed version. Detailed patch information and download links are available in the Progress MOVEit Update Notice. Progress recommends upgrading to the latest available version to ensure all security fixes are applied.

Workarounds

• Implement strict web application firewall rules to block requests containing SQL injection patterns
• Limit database permissions for the MOVEit Transfer service account to minimum required privileges
• Enable enhanced logging and monitoring to detect exploitation attempts before patches can be applied
• Consider temporarily restricting access to the MOVEit Transfer web interface to trusted networks only until patching is complete

# Configuration example - Restrict MOVEit Transfer access via firewall
# Allow only specific trusted IP ranges to access MOVEit Transfer
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP