How to Fix CVE-2023-35708- A Critical SQL Injection Vulnerability in MOVEit Transfer Solution?

Progress Software has issued an advisory regarding a critical SQL injection vulnerability, tracked as CVE-2023-35708, affecting its MOVEit Transfer solution. This vulnerability could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database and contents. In this post, we will provide an overview of the vulnerability, affected versions, and how to fix CVE-2023-35708, critical SQL Injection vulnerabilities in MOVEit Transfer Solution.

Introduction to MOVEit Transfer Solution

MOVEit Transfer is a managed file transfer solution that enables organizations to securely transfer sensitive data between systems and users. It supports multiple protocols like SFTP, FTPS, HTTPS, AS2, etc, and provides encryption to safeguard data. MOVEit Transfer also helps organizations meet compliance requirements related to data security and privacy.

Key features include:

Summary of the Vulnerability

CVE-2023-35708 is a critical severity SQL injection vulnerability affecting MOVEit Transfer versions before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7) and 2023.0.3 (15.0.3).

By sending specially crafted input to MOVEit Transfer endpoints, an attacker could exploit this vulnerability to modify and disclose the contents of the backend database. This could result in unauthorized data access and manipulation.

The vulnerability was reported to be actively exploited in the wild by threat actors in June 2022. It allows exploitation over both HTTP and HTTPS.

Affected Versions

All versions of MOVEit Transfer before the patches released on June 15, 2022 are affected. This includes:

How to Fix CVE-2023-35708- A Critical SQL Injection Vulnerability in MOVEit Transfer Solution?

Progress Software has released patches to address this vulnerability. Users are strongly advised to apply the relevant patch based on their MOVEit Transfer version:

The patches are available as full installers and drop-in DLL files. Refer to Progress Software’s advisory for links and steps to apply patches correctly.

Recommended Immediate Mitigations

Progress Software has advised customers to urgently apply several mitigations while working on patching this vulnerability:

Applying Vendor Patches to Fix CVE-2023-35708

Progress Software has released patches resolving this SQL injection flaw for supported MOVEit Transfer versions:

For MOVEit Transfer 2021.0.x, 2021.1.x, 2022.0.x, 2022.1.x and 2023.0.x, users should download and install the relevant fixed release from the vendor advisory.

Those on older unsupported editions like 2020.1.x or 12.0.x must upgrade to a supported version first before installing the patches.

The fixes are available both as full installers and drop-in DLL packages. The DLLs allow quicker updating by just replacing a few binaries instead of full installations. Refer to Progress’ documentation for steps on applying patches correctly.

It is critical that customers immediately update their MOVEit Transfer deployments to close this SQL injection vulnerability before threat actors can exploit it for data theft, destruction or disruption.

Ongoing Security Best Practices

In addition to applying these specific fixes, organizations should adopt these best practices to enhance MOVEit Transfer security:

Combining prompt patching with robust hardening and logging enables organizations to minimize future SQL injection and other application-layer threats against MOVEit Transfer deployments.

Conclusion

SQL injection vulnerabilities like CVE-2023-35708 demand urgent attention before malicious actors exploit them to compromise sensitive data. MOVEit Transfer users should follow Progress Software’s recommendations to mitigate and patch this high-risk vulnerability. Along with patching, adopting ongoing security best practices is key to protecting MOVEit Transfer’s confidentiality, integrity and availability.

We hope this post helped you know how to fix CVE-2023-35708, critical SQL Injection vulnerabilities in MOVEit Transfer Solution. Please share this post if you find this interested. Visit our website thesecmaster.com, and our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium, and Instagram and subscribe to receive updates like this.

You may also like these articles: