Product Update
Introducing Emerging Threats
Update - June 16, 2023
A further vulnerability within MOVEit Transfer has been discovered and patches are available as of June 16, 2023.
Update - June 12, 2023
Additional vulnerabilities within MOVEit Transfer have been discovered and patches are available as of June 9, 2023.
A critical SQL injection vulnerability has been identified in Progress Software’s MOVEit Transfer product that is proven to result in unauthorised access to files and the ability for arbitrary code execution. It is being actively exploited with multiple high profile organisations reported to be affected. MOVEit Transfer is widely used for secure file transfer. Security patches are available for all supported versions of the software.
Progress Software posted a security advisory on May 31, 2023, detailing a critical vulnerability within its MOVEit Transfer product. MOVEit Transfer is an on-premises Managed File Transfer software, used by organisations globally for secure file transfer and collaboration.
All versions are affected, but patches are available and should be applied immediately.
Additional vulnerabilities within MOVEit Transfer have been discovered and patches are available as of June 9, 2023.
The MOVEit Cloud platform was also affected but has been patched and thoroughly tested, with important information for MOVEit Cloud customers here.
The SQL injection vulnerability allows an attacker to ultimately gain unauthenticated remote access to any file within the system. Huntress also report that arbitrary code execution is possible.
It is likely that the vulnerability has been actively exploited since at least May 28, 2023.
There are over 2500 servers exposed to the public internet around the world. Rapid7 have reported an uptick in the exploitation of the vulnerability since it was announced and advise remediation on an emergency basis.
Reports suggest that many high profile organisations have experienced data exfiltration, including contact and bank details.
Microsoft are attributing attacks to ‘Lace Tempest’ (aka Cl0p), a group known for ransomware and extortion. However other threat actors may also be actively exploiting the vulnerability.
The vulnerability was assigned CVE-2023-34362 on June 5, 2023.
The threat is applicable to any organisations that make use of the Progress MOVEit Transfer software, which includes both blue chip enterprises and smaller businesses globally. There is a particularly high concentration of affected organisations within the United States, but the software is used worldwide.
In the UK, British Airways, Boots and the BBC have all been affected and payroll provider, Zellis, confirmed that a number of their customers have been impacted.
It is important to understand the extent to which your supply chain is affected by this threat, particularly the potential impact from third parties that may use the Progress MOVEit Transfer software to transfer files to and from their customers.
Given the verified threat of unauthorised access to files and data exfiltration, any business files held by other organisations within the supply chain may be at risk of being breached, resulting in the loss of confidential information.
There are immediate actions you should take to protect yourself from this threat.
If you are a customer of MOVEit Cloud, read the article here and review your audit logs for signs of unexpected file downloads.
If you use MOVEit Transfer in your own environments:
This is an evolving situation. You can keep up to date with the latest information on this threat by following…
To understand how your supply chain is affected by the MOVEit Transfer vulnerability, create your free account on Risk Ledger. You can find out more about how the Emerging Threats feature on Risk Ledger works here.
Sign up to our monthly newsletter to receive exclusive research and analyses by our experts, the latest case studies from our clients as well as guides, explainers and more to turn your supply chain risk management programme into a resounding success story.
