MOVEit app mass-exploited last month patches new critical vulnerability

MOVEit, the file-transfer software exploited in recent weeks in one of the biggest cyberattacks ever, has received yet another security update that fixes a critical vulnerability that could be exploited to give hackers access to vast amounts of sensitive data.

On Thursday, MOVEit-maker Progress Software published a security bulletin that included fixes for three newly discovered vulnerabilities in the file-transfer application. The most serious of them, tracked as CVE-2023-36934, allows an unauthenticated attacker to gain unauthorized access to the application database. It stems from a security flaw that allows for SQL injection, one of the oldest and most common exploit classes.

The vulnerability contains the same elements—and, likely, the same potentially devastating consequences—as one that came to light in late May when members of the Clop ransomware crime syndicate began mass-exploiting it on vulnerable networks around the world. To date, the Clop offensive has hit 229 organizations and spilled data affecting more than 17 million people, according to statistics tracked by Brett Callow, an analyst with security firm Emsisoft. Casualties include Louisiana and Oregon DMVs, the New York City Department of Education, and energy companies Schneider Electric and Siemens Electric.

There are no known reports of the new vulnerability coming under active exploitation, but given its severity and past experience, Progress Software and security practitioners are urging all MOVEit users to install it right away. Besides CVE-2023-36934, Thursday’s security update patches two additional vulnerabilities. All of them were discovered by security firms HackerOne and Trend Micro.

Developers, meet Bobby Tables

One thing that makes CVE-2023-36934 and the earlier vulnerability exploited by Clop so critical is that they can be exploited by people when they’re not even logged in to the system they’re hacking. Both also stem from bugs that allow for SQL injection, a vulnerability class with a long history of abuse. Often abbreviated as SQLi, it stems from a failure by a web application to properly query backend databases. SQL syntax uses apostrophes to indicate the beginning and end of a data string. The apostrophes allow SQL parsers to distinguish between data strings and database commands.