• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer

My TechDecisions

  • Best of Tech Decisions
  • Topics
    • Video
    • Audio
    • Mobility
    • Unified Communications
    • IT Infrastructure
    • Network Security
    • Physical Security
    • Facility
    • Compliance
  • RFP Resources
  • Resources
  • Podcasts
  • Subscribe
  • Project of the Week
  • About Us
    SEARCH
IT Infrastructure, Network Security, News

Act Now: Vulnerability in Progress Software’s MOVEit Transfer Software

Cybersecurity researchers are sounding the alarm on a new zero-day vulnerability in Progress Software’s MOVEit Transfer solution.

June 2, 2023 Zachary Comeau Leave a Comment

MOVEit vulnerability, zero-day, Progress Software
stock.adobe.com/ribkhan

Cybersecurity companies and researchers are sounding the alarm on a new zero-day vulnerability in Progress Software’s MOVEit Transfer solution, with attackers pouncing on the vulnerability since it was disclosed by Progress Software on May 31.

According to Progress Software, the vulnerability in MOVEit Transfer could lead to escalated privileges and potential unauthorized access to the environment. MOVEit Transfer customers are advised to take immediate action to help protect their environment. Organizations are urged to apply the patch immediately.

Affecting all supported MOVEit Transfer versions, the bug is an SQL injection vulnerability that could allow an unauthenticated attacker to gain access to MOVEit Transfer’s database.

“Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database in addition to executing SQL statements that alter or delete database elements,” the company says.

Defending against the MOVEit zero-day vulnerability

To prevent exploitation of the vulnerability, organizations are urged to disable all HTTP and HTTPs traffic to their MOVEit environment, delete unauthorized files and user accounts, reset credentials, and apply a patch. Customers on unsupported versions should upgrade to a supported version, Progress Software says.

After applying the patch, organizations should enabled HTTP and HTTPs traffic, ensure that no unauthorized accounts remain, and continue to monitor the network, endpoints and logs for indicators of compromise. Organizations should look for indicators of compromise dating back at least a month.

Read the company’s advisory for additional security best practices to help defend against exploitation of this vulnerability, which as of Friday, has no CVE assigned.

According to cybersecurity firm Rapid7, there were roughly 2,5000 instances of MOVEit Transfers exposed to the public internet as of May 31, with the majority located in the U.S. Similar SQLi-to-RCE flaws in network edge systems can provide threat actors with initial access to corporate networks, the company says.

Rapid7 says its researchers observed the same webshell name in multiple customer environments, which could be an indicator of automated exploitation.

Rapid7 analyzed a sample webshell payload associated with successful exploitation. The webshell code would first determine if the inbound request contained a header named X-siLock-Comment, and would return a 404 “Not Found” error if the header was not populated with a specific password-like value. As of June 1, 2023, all instances of Rapid7-observed MOVEit Transfer exploitation involve the presence of the file human2.aspx in the wwwroot folder of the MOVEit install directory (human.aspx is the native aspx file used by MOVEit for the web interface).

Ransomware groups leveraging file transfer solutions

The vulnerability in MOVEit Transfer is the latest case of cybercriminals targeting file transfer tools, specifically with ransomware groups who are moving away from encryption and focusing solely on data theft to compel their victims to pay the ransom.

Satnam Narang, senior staff research engineer at Tenable, says file transfer applications have become increasingly popular among ransomware groups since late 2020. One group in particular, Clop, has breached “hundreds of organizations: that use those tools to transfer sensitive data.

“While we don’t know the specifics around the group behind the zero day attacks involving MOVEit, it underscores a worrisome trend of threat actors targeting file transfer solutions,” Narang says. “Organizations that use MOVEit software should assume compromise and engage in incident response to determine the potential impact, if any.”

If you enjoyed this article and want to receive more valuable industry content like this, click here to sign up for our digital newsletters!

Tagged With: Cybersecurity, MOVEit, Progress Software, Rapid7, zero-day vulnerability

Related Content:

  • data breach Nearly 900 Schools Impacted by National Student Clearinghouse…
  • Rearview shot of two young designers giving each other a fist bump in an office, on display is Crestron desk scheduling device Crestron Introduces Desk Q and Desk Touch Scheduling…
  • CI SSI cover Commercial Integrator and Security Sales & Integration Magazines…
  • cyber-attack-skull Spike in Cyberattacks Exposes Vulnerabilities in University Security…

Free downloadable guide you may like:

  • Download TechDecisions' Blueprint Series report on Security Awareness now!Blueprint Series: Why Your Security Awareness Program is Probably Falling Short

    Learn about the evolution of phishing attacks and best practices for security awareness programs to ensure your organization is properly prepared to defend against them in this report from TechDecisions' Blueprint Series.

Reader Interactions

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Get the FREE Tech Decisions eNewsletter

Sign up Today!

Latest Downloads

Download TechDecisions' Blueprint Series report on Security Awareness now!
Blueprint Series: Why Your Security Awareness Program is Probably Falling Short

Learn about the evolution of phishing attacks and best practices for security awareness programs to ensure your organization is properly prepared t...

Workplace Collaboration Tools for Corporate Spaces
Workplace Collaboration Tools for Corporate Spaces

From lobbies and shared spaces to conference rooms and multipurpose facilities, you need high-performing AV technology to effectively share informa...

ChatGPT, generative AI, enterprise, workplace
Blueprint Series: ChatGPT and Generative AI in the Workplace

This latest release of the TechDecisions Blueprint Series explores the new phenomenon of tools such as ChatGPT and how IT leaders should go about d...

View All Downloads

Would you like your latest project featured on TechDecisions as Project of the Week?

Apply Today!
Sharp Microsoft Collaboration HQ Logo

Learn More About the
Windows Collaboration Display

More from Our Sister Publications

Get the latest news about AV integrators and Security installers from our sister publications:

Commercial IntegratorSecurity Sales

AV-iQ

Footer

TechDecisions

  • Home
  • Welcome to TechDecisions
  • Subscribe to the Newsletter
  • Contact Us
  • Advertise with Us
  • Comment Guidelines
  • RSS Feeds
  • Twitter
  • Facebook
  • Linkedin

Free Technology Guides

FREE Downloadable resources from TechDecisions provide timely insight into the issues that IT, A/V, and Security end-users, managers, and decision makers are facing in commercial, corporate, education, institutional, and other vertical markets

View all Guides
TD Project of the Week

Get your latest project featured on TechDecisions Project of the Week. Submit your work once and it will be eligible for all upcoming weeks.

Enter Today!
Emerald Logo
ABOUTCAREERSAUTHORIZED SERVICE PROVIDERSDO NOT SELL MY PERSONAL INFORMATIONTERMS OF USEPRIVACY POLICY

© 2023 Emerald X, LLC. All rights reserved.