Security News > 2023 > June > Critical zero-day vulnerability in MOVEit Transfer exploited by attackers!
A critical zero-day vulnerability in Progress Software's enterprise managed file transfer solution MOVEit Transfer is being exploited by attackers to grab corporate data.
" could lead to escalated privileges and potential unauthorized access to the environment," the company warned on Wednesday, and advised customers to take action to protect their MOVEit Transfer environment, "While our team produces a patch."
"A bunch of people have alerted me to a vulnerability in MoveIT, a secure file transfer app used heavily in the UK. I did some digging and it looks like it's a zero day under active exploitation. Not 100% on threat actor yet but it may be one of the ransomware/extortion groups," says security researcher Kevin Beaumont.
According to cybersecurity specialist Daniel Card, there seem to be over 2,500 MOVEit Transfer servers discoverable on the internet, mostly in the US. MOVEit Transfer vulnerability: What can you do?
One commenter on Reddit says that their employer was affected over the Memorial Day weekend and that a ton of files were copied from their MoveIt sites, and others are advising defenders on specific indicators of compromise to look for.
If this is confirmed, it will be the second instance of a zero-day in an enterprise managed file transfer tool being exploited by attackers this year - the first was CVE-2023-0669, a remote code execution vulnerability in Fortra's GoAnywhere solution, leveraged by the Cl0p ransomware gang.
News URL
https://www.helpnetsecurity.com/2023/06/01/moveit-transfer-vulnerability/
Related news
- Hackers target critical zero-day vulnerability in PTZ cameras (source)
- Critical NVIDIA Container Toolkit Vulnerability Could Grant Full Host Access to Attackers (source)
- Critical Zimbra RCE vulnerability under mass exploitation (CVE-2024-45519) (source)
- Apple Releases Critical iOS and iPadOS Updates to Fix VoiceOver Password Vulnerability (source)
- Week in review: Critical Zimbra RCE vulnerability exploited, Patch Tuesday forecast (source)
- Zero-Day Alert: Three Critical Ivanti CSA Vulnerabilities Actively Exploited (source)
- Experts Warn of Critical Unpatched Vulnerability in Linear eMerge E3 Systems (source)
- New Critical GitLab Vulnerability Could Allow Arbitrary CI/CD Pipeline Execution (source)
- Critical Veeam Vulnerability Exploited to Spread Akira and Fog Ransomware (source)
- Critical Kubernetes Image Builder Vulnerability Exposes Nodes to Root Access Risk (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-02-06 | CVE-2023-0669 | Deserialization of Untrusted Data vulnerability in Fortra Goanywhere Managed File Transfer Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. | 7.2 |