MOVEit Transfer (CVE-2023-34362): A Mass Exploitation Data-Theft Campaign

Summary

Starting around May 27, 2023, the Cl0p ransomware group exploited a previously unknown SQL injection vulnerability in Progress Software's MOVEit Transfer, a managed file transfer product, tracked as CVE-2023-34362. The campaign is estimated to have affected over 2,700 organizations and exposed data on tens of millions of individuals, making it one of the largest mass-exploitation data-theft events on record.

Technical Root Cause

CVE-2023-34362 was a SQL injection vulnerability (CWE-89) in MOVEit Transfer's web application that could lead to escalated privileges and unauthorized access to the underlying database, allowing attackers to deploy a web shell (later named LEMURLOOT) for persistent access and to exfiltrate stored files.

Why It Mattered

Unlike a targeted intrusion, this was a mass, largely automated exploitation campaign against every internet-facing MOVEit Transfer instance the attackers could find, run over a short window before patches were widely applied. Because MOVEit Transfer is used specifically to move sensitive files between organizations (including for payroll, healthcare, and government data), the breadth of exposed data was unusually large relative to a single-vulnerability incident.

OWASP / CWE Mapping

• CWE-89: SQL Injection
• OWASP A03:2021: Injection

Lasting Impact

The MOVEit campaign reinforced two lessons already familiar from other incidents on this list: internet-facing file-transfer and management software is a high-value target precisely because of what it's designed to hold, and a single vendor vulnerability can cascade to thousands of downstream organizations that never directly chose to expose themselves to that risk.

How Safeguard Helps

Safeguard's DAST scanning is designed to catch injection-class vulnerabilities like this in web-facing applications before they reach production, and vulnerability tracking flags newly disclosed CVEs in deployed software so patching can be prioritized quickly for actively-exploited issues.

References

• CVE-2023-34362: https://nvd.nist.gov/vuln/detail/CVE-2023-34362
• CWE-89: https://cwe.mitre.org/data/definitions/89.html