Critical Vulnerability in MOVEit Transfer

THE THREAT

eSentire is aware of reports relating to the active exploitation of a currently unnamed vulnerability impacting Progress Software’s managed file transfer software MOVEit Transfer. Progress disclosed the vulnerability in an advisory on May 31st, 2023. Exploitation of vulnerability allows threat actors to perform privilege escalation and gain unauthorized access to the environment.

Organizations using MOVEit Transfer need to take immediate actions and apply relevant security patches or the alternative mitigations that are outlined by Progress.

What we’re doing about it

• The eSentire Threat Response Unit (TRU) has performed threat hunts across the client base
• eSentire Managed Vulnerability Service will add the relevant plugins when they become available
• The eSentire Threat Intelligence team is actively tracking this topic for additional details and detection opportunities

What you should do about it

• After performing a business impact review, apply relevant security patches
• If patching is not immediately possible, apply alternative mitigations provided by Progress (See Additional Information)
• Review potentially impacted devices for Indicators of unauthorized access
  • Creation of unexpected files, specifically ‘human2[.]aspx’, in the c:\MOVEit Transfer\wwwroot\ folder
  • Any unexpected or large file downloads

Additional information

Details on real world exploitation of this vulnerability, have not been publicly disclosed at this time. Based on wording from Progress’ advisory, it is highly probably that exploitation has been ongoing for at least the past 30 days.

The MOVEit Transfer platform is meant to enable secure transfer of sensitive files. Exploitation of this vulnerability may enable the theft of sensitive materials that would then be sold or used in extortion type attacks.

Impacted MOVEit Transfer Versions:

• 2023.0.0
• 2022.1.x
• 2022.0.x
• 2021.1.x
• 2021.0.x

Alternative Mitigations [1]:

• Disable all HTTP and HTTPs traffic to your MOVEit Transfer environment – Additional support is available via the Progress Technical Support channel
  • This mitigation will directly impact MOVEit functionality and access

References:

[1] https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023
[2] https://community.progress.com/s/supportlink-landing