CVE-2023-36934: Progress MOVEit Transfer SQLi Vulnerability

CVE-2023-36934 Overview

CVE-2023-36934 is a critical SQL injection vulnerability discovered in Progress MOVEit Transfer, a widely-used managed file transfer (MFT) solution. This vulnerability affects the MOVEit Transfer web application and allows unauthenticated attackers to gain unauthorized access to the MOVEit Transfer database. By submitting a specially crafted payload to a MOVEit Transfer application endpoint, attackers can modify and disclose sensitive database content without requiring any authentication.

Critical Impact

Unauthenticated attackers can exploit this SQL injection vulnerability to access, modify, and extract sensitive data from MOVEit Transfer databases, potentially compromising enterprise file transfer operations and exposing confidential information.

Affected Products

• Progress MOVEit Transfer before 2020.1.11 (12.1.11)
• Progress MOVEit Transfer before 2021.0.9 (13.0.9)
• Progress MOVEit Transfer before 2021.1.7 (13.1.7)
• Progress MOVEit Transfer before 2022.0.7 (14.0.7)
• Progress MOVEit Transfer before 2022.1.8 (14.1.8)
• Progress MOVEit Transfer before 2023.0.4 (15.0.4)

Discovery Timeline

• 2023-07-05 - CVE-2023-36934 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-36934

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) exists in the MOVEit Transfer web application and represents a severe security flaw that enables database compromise without authentication. The vulnerability allows remote attackers to inject malicious SQL commands through crafted payloads submitted to application endpoints, bypassing normal access controls entirely.

The unauthenticated nature of this vulnerability significantly increases its risk profile. Unlike authenticated SQL injection flaws that require valid credentials, this vulnerability can be exploited by any attacker with network access to the MOVEit Transfer web interface. The exploitation can lead to both data disclosure (reading sensitive information from the database) and data modification (altering database records).

MOVEit Transfer is commonly deployed in enterprise environments to facilitate secure file transfers, often containing sensitive business documents, financial data, and personal information. Successful exploitation could expose this critical data and potentially allow attackers to manipulate transfer records or user accounts.

Root Cause

The root cause of CVE-2023-36934 is improper input validation and sanitization in the MOVEit Transfer web application. User-supplied input is not adequately validated before being incorporated into SQL queries executed against the backend database. This allows attackers to break out of the intended query structure and inject arbitrary SQL commands that the database engine executes with the application's privileges.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying an exposed MOVEit Transfer web application endpoint
2. Crafting a malicious payload containing SQL injection syntax
3. Submitting the payload to the vulnerable endpoint
4. Extracting or modifying database content based on the SQL commands executed

The vulnerability targets application endpoints that process user input without proper sanitization, allowing SQL metacharacters and commands to be interpreted by the database engine rather than treated as literal data.

Detection Methods for CVE-2023-36934

Indicators of Compromise

• Unusual SQL error messages appearing in MOVEit Transfer application logs
• Unexpected database queries containing SQL injection patterns such as UNION SELECT, single quotes, or comment sequences (--, /**/)
• Anomalous data access patterns or bulk data extraction from the MOVEit Transfer database
• Suspicious HTTP requests to MOVEit Transfer endpoints containing encoded or malformed parameters

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block SQL injection payloads targeting MOVEit Transfer endpoints
• Implement database activity monitoring to detect unusual query patterns, failed queries, or unauthorized data access
• Enable detailed logging on MOVEit Transfer servers and review logs for SQL injection indicators
• Use network intrusion detection systems (NIDS) with signatures for SQL injection attack patterns

Monitoring Recommendations

• Monitor MOVEit Transfer web server logs for requests containing SQL injection keywords and special characters
• Set up alerts for database errors that may indicate injection attempts or successful exploitation
• Track authentication events and database access patterns for anomalies indicating unauthorized access
• Implement real-time monitoring of outbound data transfers that could indicate data exfiltration

How to Mitigate CVE-2023-36934

Immediate Actions Required

• Update MOVEit Transfer to the latest patched version immediately: 2020.1.11, 2021.0.9, 2021.1.7, 2022.0.7, 2022.1.8, or 2023.0.4 (or later) depending on your version branch
• Review database logs for signs of exploitation or unauthorized access prior to patching
• Restrict network access to MOVEit Transfer web interfaces to authorized IP ranges using firewall rules
• Implement WAF rules to provide additional protection against SQL injection attacks while patching is in progress

Patch Information

Progress has released security updates addressing CVE-2023-36934 across multiple MOVEit Transfer version branches. Organizations should apply the appropriate service pack for their deployed version. Detailed patch information is available in the Progress MOVEit Transfer Service Pack Advisory.

The following minimum versions address this vulnerability:

• Version 12.x: Update to 2020.1.11 (12.1.11) or later
• Version 13.0.x: Update to 2021.0.9 (13.0.9) or later
• Version 13.1.x: Update to 2021.1.7 (13.1.7) or later
• Version 14.0.x: Update to 2022.0.7 (14.0.7) or later
• Version 14.1.x: Update to 2022.1.8 (14.1.8) or later
• Version 15.x: Update to 2023.0.4 (15.0.4) or later

Workarounds

• Implement network-level access controls to restrict access to MOVEit Transfer web interfaces to trusted networks only
• Deploy a web application firewall (WAF) configured with SQL injection detection rules in front of MOVEit Transfer
• Disable or restrict access to non-essential MOVEit Transfer endpoints until patches can be applied
• Monitor database activity closely for any signs of SQL injection attempts or unauthorized data access

# Example: Restrict MOVEit Transfer access using iptables
# Allow only specific trusted IP ranges to access MOVEit Transfer web port
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP