CVE-2023-34362 — MOVEit Transfer SQL Injection¶

Q: How do I detect CVE-2023-34362?

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

Q: How do I block or mitigate CVE-2023-34362?

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Q: Is CVE-2023-34362 actively exploited?

Yes. CVE-2023-34362 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2023-06-02, which means it has been exploited in the wild. CISA also links it to known ransomware campaigns. CISA set a federal remediation deadline of 2023-06-23. Prioritise patching and deploy the detection and prevention rules above.

Key facts

CVE-2023-34362 is a Critical (9.8) vulnerability: MOVEit Transfer SQL Injection. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2023-06-02), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

Actively exploited — on the CISA KEV catalog

CVE-2023-34362 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2023-06-02), confirming exploitation in the wild. It is linked to known ransomware campaigns. Federal remediation deadline: 2023-06-23. Prioritise patching and deploy the detection and prevention rules below.


CVE	CVE-2023-34362
Severity	Critical (9.8)
CISA KEV	Actively exploited (added 2023-06-02) · ransomware
Product	Progress MOVEit Transfer
Detection / prevention	Snort, YARA, Nginx, Apache
PoC	poc.py
Source	2023/CVE-2023-34362/

Details¶

CVE-2023-34362 (Progress MOVEit Transfer) is a Critical (9.8) vulnerability: MOVEit Transfer SQL Injection. This entry ships a detection-only proof-of-concept (PoC), a Docker test lab, and ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) — see Detection and prevention below. Source: NVD record.

Attribute	Value
CVE ID	CVE-2023-34362
CVSS Score	9.8 (Critical)
Product	Progress MOVEit Transfer
Type	SQL Injection
CWE	CWE-89 (Improper Neutralization of Special Elements in SQL)

Description¶

Critical SQL injection vulnerability in Progress MOVEit Transfer web application that allows unauthenticated attackers to gain access to the MOVEit Transfer database. This vulnerability was mass-exploited by the Cl0p ransomware group, affecting over 2,770 organizations and approximately 96 million individuals.

Affected Versions¶

MOVEit Transfer < 2023.0.2 (15.0.2)
MOVEit Transfer 2022.1.x < 2022.1.6 (14.1.6)
MOVEit Transfer 2022.0.x < 2022.0.5 (14.0.5)
MOVEit Transfer 2021.1.x < 2021.1.5 (13.1.5)
MOVEit Transfer 2021.0.x < 2021.0.7 (13.0.7)

Verification Process¶

The PoC uses a multi-stage verification approach:

Step 1: Product Detection (Passive)¶

[*] Query /human.aspx, /machine.aspx, /guestaccess.aspx
[*] Detect MOVEit signatures and extract version
[*] Check if version is in vulnerable range

Step 2: Active SQL Injection Testing¶

Method	Description	Detection
Error-based	Injects malformed SQL to trigger error messages	Response contains "SQLException", "syntax error", etc.
Time-based	Injects WAITFOR DELAY / SLEEP commands	Response time increases by delay amount
Boolean-based	Compares TRUE vs FALSE condition responses	Significant response size/status difference
MOVEit-specific	Tests /moveitisapi/moveitisapi.dll endpoint	SQL execution indicators in response

Verification Flow¶

┌─────────────────────────────────────────────────────────────┐
│                    Product Detection                         │
│  GET /human.aspx → Check for "MOVEit" signature             │
│  Extract version → Check if < 2023.0.2                      │
└─────────────────────────────────────────────────────────────┘
                              ↓
┌─────────────────────────────────────────────────────────────┐
│               Active SQL Injection Testing                   │
│                                                              │
│  1. Error-based SQLi                                         │
│     └─ Inject: 1' OR ''='                                   │
│     └─ If "SQLException" in response → CONFIRMED            │
│                                                              │
│  2. Time-based SQLi                                          │
│     └─ Inject: '; WAITFOR DELAY '0:0:3'--                   │
│     └─ If response_time > baseline + 3s → CONFIRMED         │
│                                                              │
│  3. Boolean-based SQLi                                       │
│     └─ Compare: 1' AND '1'='1 vs 1' AND '1'='2             │
│     └─ If significant diff in response → CONFIRMED          │
│                                                              │
│  4. MOVEit-specific Endpoint                                 │
│     └─ GET /moveitisapi/moveitisapi.dll?action=m2&arg01=... │
│     └─ If SQL execution indicator → CONFIRMED               │
└─────────────────────────────────────────────────────────────┘

Usage¶

# Full vulnerability check (version + active SQLi testing)
python3 poc.py -t https://moveit.target.com -c

# Version-only check (passive, no payloads sent)
python3 poc.py -t https://moveit.target.com -c --version-only

Expected Output (Vulnerable)¶

============================================================
CVE-2023-34362 - MOVEit Transfer SQL Injection
CVSS: 9.8 (Critical) | Affects: MOVEit Transfer < 2023.0.2
============================================================

[*] Target: https://moveit.target.com
[*] Step 1: Detecting MOVEit Transfer...
[*] Detected: MOVEit Transfer 2022.1.5
[!] Version 2022.1.5 is in vulnerable range
[*] Step 2: Active SQL injection testing...
[*] Testing error-based SQL injection...
[!] VULNERABLE - SQL error detected

============================================================
RESULTS
============================================================
[!] STATUS: VULNERABLE
[!] Method: error_based
[!] Details: CONFIRMED: SQL error detected with payload "1'" at /guestaccess.aspx
[*] Version: MOVEit Transfer 2022.1.5

Mitigation¶

Upgrade immediately to patched versions:
MOVEit Transfer 2023.0.2 or later
MOVEit Transfer 2022.1.6 or later
MOVEit Transfer 2022.0.5 or later

Block vulnerable endpoints:

location /moveitisapi/ {
    deny all;
}

Monitor for exploitation:
Check for unusual SQL queries in logs
Look for access to moveitisapi.dll with suspicious parameters
Review file downloads for data exfiltration
Network segmentation:
Restrict MOVEit server access from internet
Use VPN or allowlisting for external access

References¶

Detection and prevention¶

Ready-to-deploy defensive rules for CVE-2023-34362, for authorized testing and blue-team detection engineering:

Snort IDS signature — prevention/snort.rules
YARA detection rule — prevention/yara.yar
Nginx mitigation — prevention/nginx.conf
Apache HTTPD mitigation — prevention/httpd.conf
Detection-only PoC — poc.py
Rule notes — prevention/README.md

References: NVD — CVE-2023-34362 · full write-up on the searchable site

Detection & prevention rules¶

Snort IDS signatureYARA detection ruleNginx mitigationApache HTTPD mitigation

# CVE-2023-34362 - Snort IDS Rules
# Severity: High

# Detect potential exploit attempts
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2023-34362 Potential Exploit Attempt";
    flow:to_server,established;
    content:".."; http_uri;
    classtype:web-application-attack;
    sid:2023343621;
    rev:1;
    metadata:cve CVE-2023-34362, severity high;
)

# Detect suspicious patterns in request
alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (
    msg:"CVE-2023-34362 Suspicious Request Pattern";
    flow:to_server,established;
    pcre:"/(%2e%2e|%252e|\x00)/Ui";
    classtype:web-application-attack;
    sid:2023343622;
    rev:1;
    metadata:cve CVE-2023-34362, severity high;
)

:material-file-download: prevention/snort.rules

/*
 * CVE-2023-34362 - YARA Detection Rules
 */

rule CVE_2023_34362_Exploit {
    meta:
        description = "Detects potential CVE-2023-34362 exploit attempts"
        author = "Security Research Team"
        severity = "high"
        cve = "CVE-2023-34362"

    strings:
        $path_traversal1 = "../" ascii wide
        $path_traversal2 = "..\" ascii wide
        $encoded1 = "%2e%2e" ascii wide nocase
        $encoded2 = "%252e" ascii wide nocase
        $null_byte = "%00" ascii wide

    condition:
        any of them
}

:material-file-download: prevention/yara.yar

# CVE-2023-34362 - Prevention Rules for Nginx

# Block common exploit patterns
location / {
    # Rate limiting
    limit_req zone=general burst=20 nodelay;

    # Block suspicious patterns
    if ($request_uri ~* "(\.\.[\/]|%2e%2e|%252e)") {
        return 403;
    }

    # Security headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header X-XSS-Protection "1; mode=block" always;
}

# Log suspicious activity
access_log /var/log/nginx/CVE-2023-34362-access.log;
error_log /var/log/nginx/CVE-2023-34362-error.log;

:material-file-download: prevention/nginx.conf

# CVE-2023-34362 - Prevention Rules for Apache httpd

# Block common exploit patterns
<IfModule mod_rewrite.c>
    RewriteEngine On

    # Block path traversal
    RewriteCond %{REQUEST_URI} (\.\.[\/]|%2e%2e|%252e) [NC]
    RewriteRule .* - [F,L]

    # Block null bytes
    RewriteCond %{REQUEST_URI} %00 [NC]
    RewriteRule .* - [F,L]
</IfModule>

# Security headers
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set X-XSS-Protection "1; mode=block"

# Enable logging
CustomLog /var/log/httpd/CVE-2023-34362-access.log combined
ErrorLog /var/log/httpd/CVE-2023-34362-error.log

:material-file-download: prevention/httpd.conf

Frequently asked questions¶

What is CVE-2023-34362?¶

CVE-2023-34362 is a Critical (9.8) vulnerability: MOVEit Transfer SQL Injection. This entry ships ready-to-deploy detection and prevention rules (Snort, YARA, Nginx, Apache) plus a detection-only PoC and a Docker test lab. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2023-06-02), confirming active exploitation in the wild, and is linked to known ransomware campaigns.

How do I detect CVE-2023-34362?¶

Deploy the Snort and YARA detection rule included with this entry (see Detection & prevention rules below), then validate it against the detection-only PoC in the Docker test lab.

How do I block or mitigate CVE-2023-34362?¶

Apply the Nginx and Apache mitigation config included with this entry, and upgrade to a fixed version per the vendor advisory (see the NVD record for affected versions).

Is CVE-2023-34362 actively exploited?¶

Yes. CVE-2023-34362 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2023-06-02, which means it has been exploited in the wild. CISA also links it to known ransomware campaigns. CISA set a federal remediation deadline of 2023-06-23. Prioritise patching and deploy the detection and prevention rules above.

For authorized security testing and research only. See the full source and NVD record.