Progress MOVEit Transfer SQL Injection RCE (CVE-2023-34362)

CVE-2023-34362 is an unauthenticated SQL injection in Progress MOVEit Transfer MFT servers. Attackers deploy web shells (e.g. human2.aspx) and steal data from thousands of organizations — one of the largest 2023 supply-chain breaches.

Affected MOVEit

• MOVEit Transfer before 2023.0.3 (June 2023 emergency patch)
• Windows and Linux MOVEit Transfer instances
• Internet-facing MFT on ports 443/8443

Detect exposure

curl -sk https://mft.example.com/human.aspx | head -5
find /opt/MOVEit -name 'human2.aspx' -o -name '*.zip' 2>/dev/null

Patching Method

1. Isolate MOVEit from network if compromise suspected.
2. Download latest MOVEit Transfer cumulative patch from Progress support.
3. On Linux: stop MOVEit service, apply vendor patch script or RPM, run database migration if prompted.
4. On Windows: run Progress installer over existing instance.
5. Restart services; verify version in MOVEit admin console.
6. Delete unauthorized ASPX/JSP files; restore DB from clean backup if webshell found.
7. Rotate SFTP keys, API tokens, and partner credentials.

# Linux — check MOVEit version after patch
systemctl status moveit-transfer
grep -R 'Version' /opt/MOVEit/config/ 2>/dev/null

Post-patch

• Engage IR firm if human2.aspx or LEMURLOOT indicators found
• Notify data owners per breach disclosure requirements
• Segment MFT from domain controllers and databases