Vulnerability · Global · June 2023

MOVEit Transfer Mass Exploitation (CVE-2023-34362)

A SQL injection flaw in the MOVEit Transfer application for sharing files was exploited at scale to steal data from organisations worldwide.

Incident

What happened

A critical SQL injection vulnerability in Progress MOVEit Transfer allowed unauthenticated access to the application database.

The Cl0p ransomware group exploited it to deploy a web shell and exfiltrate stored files from many organisations.

Government agencies, including CISA and the FBI, published a joint advisory describing the campaign.

Analysis

Lessons learned

File transfer platforms exposed to the internet are valuable targets and need priority patching.

Injection flaws remain among the most damaging web application weaknesses.

Monitoring for unexpected files and web shells helps detect activity after exploitation.

Prevention

How penetration testing helps

Web application penetration testing examines input handling, authentication, and exposed functionality of critical business applications such as file transfer portals.

Sources

NVD, CVE-2023-34362

Summary based on publicly available information. DIGITPOL HK was not involved in this incident.