CVE-2024-0396 Overview
CVE-2024-0396 affects Progress MOVEit Transfer, a managed file transfer product widely deployed for regulated data exchange. The flaw is an input validation issue [CWE-20] that allows an authenticated user to manipulate a parameter within an HTTPS transaction. The modified request triggers computational errors inside MOVEit Transfer and can lead to a denial of service condition against the application.
The vulnerability affects MOVEit Transfer releases prior to 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), and 2023.1.3 (15.1.3). Exploitation requires network access and valid authentication, but no user interaction.
Critical Impact
An authenticated attacker can send a crafted HTTPS request that forces computational errors in MOVEit Transfer, disrupting file transfer services for all users of the platform.
Affected Products
- Progress MOVEit Transfer versions before 2022.0.10 (14.0.10)
- Progress MOVEit Transfer versions before 2022.1.11 (14.1.11) and before 2023.0.8 (15.0.8)
- Progress MOVEit Transfer versions before 2023.1.3 (15.1.3)
Discovery Timeline
- 2024-01-17 - CVE-2024-0396 published to the National Vulnerability Database
- 2024-01-17 - Progress publishes the MOVEit Transfer Service Pack January 2024 advisory
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-0396
Vulnerability Analysis
CVE-2024-0396 is an improper input validation weakness in the HTTPS request-handling path of MOVEit Transfer. The application accepts a request parameter without adequately verifying its expected type, range, or format. When the parameter is manipulated, downstream logic performs calculations on the malformed value and enters an error state.
The resulting computational error impacts the availability of the service. Progress classifies the issue as a denial of service condition, and the CVSS vector indicates a high availability impact with low integrity impact and no confidentiality impact. Attackers cannot use this issue alone to read files or execute code, but they can disrupt file transfer workflows that many organizations rely on for compliance and business operations.
Root Cause
The root cause is missing or insufficient validation of a user-supplied parameter transmitted over HTTPS. MOVEit Transfer trusts the input structure and passes it to computation logic that cannot handle unexpected values, producing an error that degrades or interrupts the service.
Attack Vector
Exploitation requires the attacker to authenticate to MOVEit Transfer over the network. Any account with valid credentials, including low-privileged users, can send the manipulated HTTPS transaction. No user interaction from another party is required, and the attack does not require elevated privileges.
No public proof-of-concept, exploit code, or in-the-wild exploitation has been reported. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability sits at 0.539%.
For technical background on the affected product, see the Progress MOVEit product overview.
Detection Methods for CVE-2024-0396
Indicators of Compromise
- Sudden spikes of HTTP 500 responses or application exceptions in MOVEit Transfer web logs originating from a single authenticated session.
- Unexpected restarts, worker process crashes, or service unavailability of the MOVEit Transfer application pool.
- Malformed parameter values in HTTPS POST or GET requests from authenticated users, particularly non-numeric input where numeric input is expected.
Detection Strategies
- Monitor IIS and MOVEit Transfer application logs for repeated error responses correlated with a specific authenticated user or source IP address.
- Alert on abnormal request patterns from low-privilege MOVEit accounts, including high error-to-success ratios and rapid parameter fuzzing behavior.
- Compare running versions of MOVEit Transfer against the fixed builds (14.0.10, 14.1.11, 15.0.8, 15.1.3) during routine asset audits.
Monitoring Recommendations
- Forward MOVEit Transfer application, audit, and IIS logs to a central SIEM for correlation across authentication and application layers.
- Baseline normal transfer volumes and error rates so that availability degradation is detected quickly.
- Track authenticated session activity and enforce alerting on accounts that generate anomalous request errors.
How to Mitigate CVE-2024-0396
Immediate Actions Required
- Upgrade MOVEit Transfer to a fixed release: 2022.0.10 (14.0.10), 2022.1.11 (14.1.11), 2023.0.8 (15.0.8), 2023.1.3 (15.1.3), or later.
- Inventory all internal and external MOVEit Transfer deployments, including test and disaster-recovery instances, before applying the patch.
- Review MOVEit user accounts and disable any accounts that are no longer required to reduce the pool of potential authenticated attackers.
Patch Information
Progress released fixes as part of the January 2024 service pack. Apply the update documented in the Progress MOVEit Transfer Service Pack January 2024 advisory. Verify the deployed build after installation and confirm that the application restarts cleanly.
Workarounds
- Restrict MOVEit Transfer web interface access to trusted networks or VPN users to limit exposure until patching is complete.
- Enforce strong authentication, including multi-factor authentication, to constrain who can reach the vulnerable request handler.
- Deploy a web application firewall in front of MOVEit Transfer with rules that reject requests containing malformed or out-of-range parameter values.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
