MOVEit Transfer Critical Vulnerability CVE-2023-34362 Rapid Response

MITRE Techniques

• [T1190] Exploit Public-Facing Application – The MOVEit Transfer web application frontend offers SQL injection that can be exploited to gain administrative access, exfiltrate files and achieve arbitrary code execution. “There is a severe vulnerability in the MOVEit Transfer web application frontend that offers SQL injection, that can be further abused to gain administrative access, exfiltrate files and gain arbitrary code execution.”
• [T1105] Ingress Tool Transfer – The backdoor components (e.g., moveitisapi.dll) are used to perform SQL injection when requested with specific headers. “moveitisapi.dll[…] is used to perform SQL injection when requested with specific headers.”
• [T1505.003] Web Shell – The observed webshell (human2.aspx) is deployed for persistence; it enforces a static password via a header and provides capabilities to leak data and manage sessions. “the backdoor will return a 404 with no further function… This password seems to vary… human2.aspx webshell.”
• [T1059] Command and Scripting Interpreter – The attack timeline includes w3wp.exe executing the C# compiler (csc.exe) to compile the human2.aspx backdoor. “w3wp.exe execute the C# compiler [csc.exe] which timing lines up with the creation of our human2.aspx backdoor.”
• [T1041] Exfiltration – The backdoor can leak data (Azure information) and return a gzip stream of files, owners, and sizes, indicating data exfiltration capabilities. “leak Azure information via response header and return a GZIP stream of all files, file owners and file sizes, and institution data present in MOVEit.”