Progress MOVEit Transfer SQL Injection and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2023-34362)
Executive & SecOps Summary
SECOPS ASSESSMENTAll MOVEit Transfer versions prior to 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, and 2023.0.1, including older unsupported versions
Unauthenticated remote attackers can manipulate the database via HTTP/HTTPS requests, potentially leading to remote code execution (RCE) and unauthorized data exfiltration
Immediately upgrade to the patched versions, restrict external HTTP/HTTPS access to the server, and conduct a thorough compromise assessment
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security patches provided by Progress Software immediately. Use the following PowerShell script to verify the currently installed version of MOVEit Transfer on Windows servers.
# Retrieve the installed MOVEit Transfer version from the registry
$registryPath = 'HKLM:\SOFTWARE\Standard Networks\MOVEitTransfer\StandardCentrals'
if (Test-Path $registryPath) {
$installPath = (Get-ItemProperty -Path $registryPath).InstallPath
Get-ItemProperty -Path "$installPath\*" | Select-Object Version, DisplayName
} else {
Write-Host 'MOVEit Transfer registry path not found.' -ForegroundColor Red
}2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, block all inbound HTTP (80) and HTTPS (443) traffic to the MOVEit Transfer server to prevent external exploitation.
# Block external HTTP and HTTPS traffic using Windows Advanced Firewall
netsh advfirewall firewall add rule name='Block_HTTP_Inbound' dir=in action=block protocol=TCP localport=80
netsh advfirewall firewall add rule name='Block_HTTPS_Inbound' dir=in action=block protocol=TCP localport=4433. Log Audit & IoC Verification Commands
Inspect the web root directory for unauthorized ASPX files created during the suspected exploitation window.
# Search for recently created or modified ASPX files in the MOVEit Transfer web root
$webRootPath = 'C:\MOVEitTransfer\wwwroot'
if (Test-Path $webRootPath) {
Get-ChildItem -Path $webRootPath -Filter '*.aspx' -Recurse |
Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
Select-Object Name, Length, LastWriteTime, FullName
} else {
Write-Host 'Default web root path does not exist.' -ForegroundColor Yellow
}Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-34362) is a critical SQL injection flaw in the MOVEit Transfer web application. The root cause lies in the application's failure to properly sanitize and validate user-supplied inputs within specific HTTP request parameters and headers. This allows unauthenticated remote attackers to inject malicious SQL commands directly into the database engine (MySQL, Microsoft SQL Server, or Azure SQL).
2. Exploitation Mechanics & Attack Scenario
Attackers exploit this vulnerability by sending specially crafted HTTP/HTTPS requests to the target MOVEit Transfer server. The typical attack flow involves:
- Authentication Bypass: The attacker leverages SQL injection to manipulate session tables, allowing them to hijack active sessions or forge administrative privileges.
- Web Shell Deployment: Once administrative access is achieved, the attacker utilizes built-in file upload features to drop malicious ASPX payloads (e.g., 'human2.aspx') into the web root.
- Remote Code Execution (RCE): The uploaded web shell is then used to execute arbitrary system commands, exfiltrate sensitive files, and establish persistent access.
3. Infrastructure & Business Impact
This vulnerability has been actively exploited in the wild and is listed on the CISA KEV catalog, representing an extreme risk to enterprise environments. Successful exploitation can lead to massive data breaches, loss of proprietary intellectual property, and severe regulatory non-compliance penalties. Furthermore, attackers can alter or delete critical database elements, causing severe operational disruption.
Official Vendor Advisories & References
In Progress MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker may be able to infer information about the structure and contents of the database, and execute SQL statements that alter or delete database elements. NOTE: this is exploited in the wild in May and June 2023; exploitation of unpatched systems can occur via HTTP or HTTPS. All versions (e.g., 2020.0 and 2019x) before the five explicitly mentioned versions are affected, including older unsupported versions.
Frequently Asked SecOps Questions (CVE-2023-34362)
FAQQ1. How critical is CVE-2023-34362 and is it actively exploited in the wild?
CVE-2023-34362 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-34362?
Primary impacted vendors include progress across moveit transfer. Scope summary: All MOVEit Transfer versions prior to 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1), including legacy unsupported versions
Q3. What temporary mitigations or workarounds exist for CVE-2023-34362 before patching?
[Mitigation] Immediately upgrade to the patched versions, restrict external HTTP/HTTPS access to the server, and conduct a thorough compromise assessment Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-34362
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (progress)
View Category →LiteLLM Proxy Server SQL Injection Vulnerability (CVE-2026-42208) Security Advisory
[Affected Scope] LiteLLM proxy server environments running versions from 1.81.16 to before 1.83.7
Progress Kemp LoadMaster API OS Command Injection Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-8037)
[Affected Scope] API management interfaces of Progress Kemp LoadMaster load balancer appliances
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Drupal Core SQL Injection Vulnerability (CVE-2026-9082) Critical Security Advisory
[Affected Scope] Drupal core versions 8.9.0 to < 10.4.10, 10.5.0 to < 10.5.10, 10.6.0 to < 10.6.9, 11.0.0 to < 11.1.10, 11.2.0 to < 11.2.12, and 11.3.0 to < 11.3.10
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.