Active exploitation of the MOVEit Transfer vulnerability — CVE-2023-34362 — by Clop ransomware group
Summary: Progress Software issued an advisory on May 31 for CVE-2023-34362, a chain of flaws in internet-facing and on-premises MOVEit Transfer instances that lets an attacker use SQL injection to obtain a sysadmin API token and then call a deserialization function to achieve remote code execution with elevated privileges. The Clop ransomware group claimed responsibility on its Tor data leak site on June 5, set a June 14 contact deadline, and used the flaw to install a previously unknown C# web shell dubbed LemurLoot that authenticates with a hardcoded 36-character GUID in the X-siLock-Comment header and connects to an attacker-controlled SQL server.
Why it matters: Clop gave victims until June 14 to make contact and has already begun publicly naming affected companies, with roughly 2,500 exposed MOVEit instances reported as of late May, mostly in the U.S. Two further vulnerabilities, CVE-2023-35036 and CVE-2023-35708, were identified in the same product within weeks, so patching once did not close the exposure.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-34362CVE-2023-35036CVE-2023-35708
- Related
- CVE-2023-34362: Progress MOVEit Transfer SQL Injection Vulnerability Known Exploited Vulnerabilities · Jun 02, 2023