Progress Software has released fixes for new vulnerabilities in its MOVEit Transfer software, and users are urged by the US Cyber and Infrastructure Security Agency (CISA) to install the patches immediately. The vulnerabilities include CVE-2023-36934, CVE-2023-36932, and CVE-2023-36933. The most critical vulnerability, CVE-2023-36934, is a SQL injection vulnerability in the MOVEit Transfer web application. If exploited with a crafted payload, unauthorized access to the MOVEit Transfer database can occur, potentially exposing and modifying its contents. This vulnerability was discovered by Guy Lederfein of Trend Micro through the Zero Day Initiative.
CVE-2023-36932 refers to several other SQL injection vulnerabilities rated as “high” severity. Crafted payloads can exploit these vulnerabilities to expose the database, allowing unauthorized modification and disclosure. The discovery credits go to cchav3z at HackerOne, Nicolas Zilio from CrowdStrike, and hoangha2, hoangnx, and duongdpt (Q5Ca) from VCSLAB of Viettel Cyber Security.
The third vulnerability, CVE-2023-36933, enables an attacker to crash MOVEit Transfer by invoking a method that triggers an unhandled exception. This vulnerability was discovered by James Horseman at HackerOne.
Progress Software has released patches to address these vulnerabilities. CISA advises users to promptly apply the updates to ensure the security of their MOVEit Transfer installations.
