CVE-2023-42660: Progress MOVEit Transfer SQLi Vulnerability

CVE-2023-42660 Overview

CVE-2023-42660 is a SQL injection vulnerability identified in Progress MOVEit Transfer, a widely-used managed file transfer solution. The vulnerability exists in the MOVEit Transfer machine interface and allows an authenticated attacker to gain unauthorized access to the MOVEit Transfer database. By submitting a crafted payload to the machine interface, an attacker could modify and disclose sensitive database content, potentially compromising the confidentiality and integrity of transferred files and associated metadata.

Critical Impact

Authenticated attackers can exploit this SQL injection flaw to access, modify, or exfiltrate sensitive data from the MOVEit Transfer database, potentially exposing confidential file transfers and organizational data.

Affected Products

• Progress MOVEit Transfer versions before 2021.1.8 (13.1.8)
• Progress MOVEit Transfer versions before 2022.0.8 (14.0.8)
• Progress MOVEit Transfer versions before 2022.1.9 (14.1.9)
• Progress MOVEit Transfer versions before 2023.0.6 (15.0.6)

Discovery Timeline

• 2023-09-20 - CVE-2023-42660 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-42660

Vulnerability Analysis

This SQL injection vulnerability (CWE-89) affects the MOVEit Transfer machine interface, which is used for automated file transfer operations between systems. The flaw allows authenticated users to inject malicious SQL statements into database queries processed by the application. Since the vulnerability requires authentication, the attacker must first obtain valid credentials to the MOVEit Transfer system before exploitation is possible. However, once authenticated, the attacker can leverage the SQL injection to bypass intended data access restrictions and interact directly with the underlying database.

The impact of successful exploitation is significant, as MOVEit Transfer databases typically contain sensitive information including file transfer logs, user credentials, configuration data, and potentially metadata about transferred files. Organizations using MOVEit Transfer for regulated data transfers (healthcare, financial, government) face heightened risk from this vulnerability.

Root Cause

The root cause of CVE-2023-42660 is improper input validation and sanitization within the MOVEit Transfer machine interface. User-supplied input is incorporated into SQL queries without adequate parameterization or escaping, allowing malicious SQL syntax to be interpreted as part of the query structure rather than as data. This represents a classic SQL injection pattern where untrusted input reaches the database layer without proper controls.

Attack Vector

The attack requires network access to the MOVEit Transfer machine interface and valid authentication credentials. An attacker would authenticate to the system and then craft HTTP requests containing SQL injection payloads targeting vulnerable parameters in the machine interface. These payloads could include UNION-based injection to extract data from other tables, time-based blind injection for data exfiltration, or stacked queries to modify database content.

The vulnerability can be exploited remotely over the network with low attack complexity once authentication is achieved. For detailed technical information about the vulnerability mechanism and exploitation patterns, refer to the Progress MOVEit Transfer Service Pack advisory.

Detection Methods for CVE-2023-42660

Indicators of Compromise

• Unusual or malformed requests to the MOVEit Transfer machine interface containing SQL syntax characters such as single quotes, UNION statements, or comment markers
• Database error messages in application logs indicating SQL syntax errors or unexpected query behavior
• Anomalous database queries or unexpected data access patterns in database audit logs
• Authentication from unusual IP addresses followed by machine interface activity

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block SQL injection patterns in requests to MOVEit Transfer endpoints
• Enable detailed logging on the MOVEit Transfer server and monitor for suspicious machine interface activity
• Implement database activity monitoring to detect unauthorized queries or data access attempts
• Review authentication logs for compromised credentials that may be used to exploit this vulnerability

Monitoring Recommendations

• Configure SIEM rules to alert on SQL injection signature patterns in HTTP request logs
• Monitor MOVEit Transfer database for unusual read/write operations or schema enumeration attempts
• Track failed and successful authentication attempts to the machine interface for anomaly detection
• Establish baseline behavior for machine interface usage and alert on deviations

How to Mitigate CVE-2023-42660

Immediate Actions Required

• Upgrade Progress MOVEit Transfer to a patched version immediately: 2021.1.8 (13.1.8), 2022.0.8 (14.0.8), 2022.1.9 (14.1.9), or 2023.0.6 (15.0.6) or later
• Review access control policies for the machine interface and restrict access to only necessary service accounts
• Audit authentication logs to identify any potentially compromised accounts
• Implement network segmentation to limit exposure of the MOVEit Transfer machine interface

Patch Information

Progress has released security patches addressing this vulnerability in the September 2023 Service Pack. Organizations should apply the appropriate update based on their current version branch. Detailed patch information and download links are available in the Progress MOVEit Transfer Service Pack September 2023 advisory.

Workarounds

• Restrict network access to the MOVEit Transfer machine interface using firewall rules to limit exposure to only trusted systems
• Implement additional authentication controls such as IP allowlisting for machine interface connections
• Deploy a web application firewall with SQL injection detection rules in front of MOVEit Transfer
• Monitor database activity closely while awaiting patch deployment to detect potential exploitation attempts

# Example: Restrict machine interface access via firewall (Linux iptables)
# Allow only trusted automation servers to access machine interface port
iptables -A INPUT -p tcp --dport 443 -s <trusted_automation_server_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP