Security News > 2023 > June > Critical zero-day vulnerability in MOVEit Transfer exploited by attackers!
A critical zero-day vulnerability in Progress Software's enterprise managed file transfer solution MOVEit Transfer is being exploited by attackers to grab corporate data.
" could lead to escalated privileges and potential unauthorized access to the environment," the company warned on Wednesday, and advised customers to take action to protect their MOVEit Transfer environment, "While our team produces a patch."
"A bunch of people have alerted me to a vulnerability in MoveIT, a secure file transfer app used heavily in the UK. I did some digging and it looks like it's a zero day under active exploitation. Not 100% on threat actor yet but it may be one of the ransomware/extortion groups," says security researcher Kevin Beaumont.
According to cybersecurity specialist Daniel Card, there seem to be over 2,500 MOVEit Transfer servers discoverable on the internet, mostly in the US. MOVEit Transfer vulnerability: What can you do?
One commenter on Reddit says that their employer was affected over the Memorial Day weekend and that a ton of files were copied from their MoveIt sites, and others are advising defenders on specific indicators of compromise to look for.
If this is confirmed, it will be the second instance of a zero-day in an enterprise managed file transfer tool being exploited by attackers this year - the first was CVE-2023-0669, a remote code execution vulnerability in Fortra's GoAnywhere solution, leveraged by the Cl0p ransomware gang.
News URL
https://www.helpnetsecurity.com/2023/06/01/moveit-transfer-vulnerability/
Related news
- Hackers target critical zero-day vulnerability in PTZ cameras (source)
- Google’s AI Tool Big Sleep Finds Zero-Day Vulnerability in SQLite Database Engine (source)
- Cisco Releases Patch for Critical URWB Vulnerability in Industrial Wireless Systems (source)
- Critical vulnerability in Cisco industrial wireless access points fixed (CVE-2024-20418) (source)
- CISA Alerts to Active Exploitation of Critical Palo Alto Networks Vulnerability (source)
- Amazon confirms employee data exposed in leak linked to MOVEit vulnerability (source)
- Palo Alto Networks warns of critical RCE zero-day exploited in attacks (source)
- Urgent: Critical WordPress Plugin Vulnerability Exposes Over 4 Million Sites (source)
- Palo Alto Networks tackles firewall-busting zero-days with critical patches (source)
- Critical SailPoint IdentityIQ Vulnerability Exposes Files to Unauthorized Access (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-02-06 | CVE-2023-0669 | Deserialization of Untrusted Data vulnerability in Fortra Goanywhere Managed File Transfer Fortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object. | 7.2 |