Sunday, July 14, 2024
EHA

Critical Vulnerability in MOVEit Transfer Let Hackers Gain Files Access

A critical security vulnerability, CVE-2024-5806, has been identified in MOVEit Transfer, a widely used managed file transfer software. The vulnerability poses significant risks to organizations relying on the software for secure data transfers.

The vulnerability is rooted in improper validation of user-supplied input during the authentication process. It can be exploited by sending specially crafted requests to the MOVEit Transfer server, bypassing authentication checks, and gaining administrative access.

The affected versions include MOVEit Transfer 2023.0.0 to 2023.0.10, 2023.1.0 to 2023.1.5, and 2024.0.0 to 2024.0.1.

Progress strongly urges all MOVEit Transfer customers using the affected versions to immediately upgrade to the latest patched version. The patched versions are as follows:

  • MOVEit Transfer 2023.0.11
  • MOVEit Transfer 2023.1.6
  • MOVEit Transfer 2024.0.2

Researchers at Rapid7 confirmed they could reproduce the exploit and achieve an authentication bypass against vulnerable, unpatched versions of MOVEit Transfer and MOVEit Gateway. 

Free Webinar! 3 Security Trends to Maximize MSP Growth -> Register For Free

Impact and Mitigation

The Improper Authentication vulnerability in MOVEit Transfer’s SFTP module can allow attackers to bypass authentication mechanisms and gain unauthorized access to the system. This could potentially lead to data breaches, theft of sensitive information, and other malicious activities.

Researchers at watchTowr initially disclosed the vulnerability and published a detailed technical analysis.

To mitigate the risk, customers are advised to upgrade to the patched versions of MOVEit Transfer using the full installer. The upgrade process will cause a system outage while running.

This vulnerability does not affect MOVEit Cloud customers, as the patch has already been deployed to the cloud infrastructure. Additionally, MOVEit Cloud is safeguarded against third-party vulnerability through strict access controls on the underlying infrastructure.

To mitigate the third-party vulnerability, Progress recommends the following steps:

  1. Verify that public inbound RDP access to MOVEit Transfer servers is blocked.
  2. Limit outbound access from MOVEit Transfer servers to only known trusted endpoints.

Progress will make the third-party vendor’s fix available to MOVEit Transfer customers once released.

Progress has acknowledged the severity of CVE-2024-5806 and is working closely with customers to ensure the vulnerability is addressed swiftly. The company has also provided detailed guidance on applying the patch and securing affected systems.

Progress encourages customers to sign up for the Progress Alert and Notification Service (PANS) to receive email notifications for future product and security updates. Customers can log into the Progress Community Portal to subscribe to PANS.

Customers can refer to Progress’s FAQ page for information and frequently asked questions about Progress Alert Notifications.

Scan Your Business Email Inbox to Find Advanced Email Threats - Try AI-Powered Free Threat Scan

Website

Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles