A SQL injection in a managed file transfer product let a ransomware group steal data from hundreds of organizations. What it teaches about file exchange systems.
Publicly disclosed: 31 May 2023
MOVEit Transfer is used by companies, banks and government bodies to exchange files securely with partners. On 31 May 2023 Progress Software warned about a critical vulnerability that was already being exploited. The Cl0p ransomware group used it to steal data from a very large number of organizations — without encrypting anything, just threatening to publish what they took.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2023-34362 | Critical, CVSS 9.8 (SQL injection) | MOVEit Transfer before the June 2023 fixes | 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, 2023.0.1 and later |
File transfer servers are always internet-facing and contain exactly what attackers want: contracts, personal data, financial reports. One vulnerability exposed the data not only of MOVEit users, but also of their clients and partners.
Data you no longer store cannot be stolen.
Sources: Progress MOVEit advisory, CISA advisory AA23-158A, NVD CVE-2023-34362.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
