Threat Brief - MOVEit Transfer SQL Injection Vulnerabilities: CVE-2023-34362, CVE-2023-35036 and CVE-2023-35708 (Updated Oct 4)
Summary: Progress Software alerted customers on May 31 to a critical SQL injection vulnerability, CVE-2023-34362, in its MOVEit Transfer managed file transfer product, followed by additional critical SQLi disclosures CVE-2023-35036 and CVE-2023-35708 on June 9 and June 15. Attackers exploited the flaw to upload a web shell that let them enumerate files and folders, read configuration information, download files, and create or delete MOVEit server user accounts, with Unit 42's earliest evidence of compromise dated May 27.
What you should know: Mandiant identified multiple cases where large volumes of files were stolen from victims' MOVEit Transfer systems, and Mandiant and Microsoft both believe the attacks are likely attributable to the Cl0p ransomware gang, so compromised organizations can likely expect extortion communications to follow.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-34362CVE-2023-35036CVE-2023-35708CVE-2023-36932CVE-2023-36933CVE-2023-36934
- Related
- Active exploitation of the MOVEit Transfer vulnerability — CVE-2023-34362 — by Clop ransomware group Cyber Risks ·CVE-2023-34362: Progress MOVEit Transfer SQL Injection Vulnerability Known Exploited Vulnerabilities · Jun 02, 2023