CVE-2023-34362: Progress MOVEit Transfer SQL Injection Vulnerability

CVE-2023-34362 is a SQL injection vulnerability in Progress MOVEit Transfer. An unauthenticated attacker can gain unauthorized access to the product's database, potentially reading its structure and contents or altering and deleting database elements. The impact depends on the database engine in use (MySQL, Microsoft SQL Server, or Azure SQL). This matters because MOVEit Transfer is commonly used for secure enterprise file transfers that handle sensitive data, and the vulnerability has known ransomware use.

IT and security teams should treat this as a high-priority issue for any environment running the software, confirm details against the vendor advisory, and follow CISA's required action to apply updates per vendor instructions.

How it works

The flaw is a classic SQL injection weakness (CWE-89). In Progress MOVEit Transfer, an unauthenticated attacker can inject malicious SQL through an exposed interface. Successful abuse lets the attacker interact directly with the backend database. Depending on the engine (MySQL, Microsoft SQL Server, or Azure SQL), the attacker may infer database structure and contents or execute statements that change or remove data. Specific request paths, payloads, or exact conditions are not detailed here and must be confirmed against the vendor advisory; the core risk is unauthorized database access without prior authentication.

Am I affected? How to find it in your systems

Progress MOVEit Transfer typically runs as a managed file-transfer server in enterprise networks, often on Windows hosts with a connected database and web-facing components for file exchange. Inventory all systems that provide secure file-transfer services and identify any installations of MOVEit Transfer. Check software inventories, configuration management databases, and network scans for the product name. Confirm exact affected versions and configurations against the vendor advisory, as those details are not provided here.

• Search asset inventories and endpoint management tools for "MOVEit Transfer" or related Progress components.
• Identify the database engine in use (MySQL, Microsoft SQL Server, or Azure SQL) for each instance, because the attacker's capabilities vary by engine.
• Review web server and application logs for anomalous unauthenticated requests that may indicate probing or injection attempts; look for unusual database query patterns or sudden access anomalies, though specific indicators of compromise must be validated against vendor or threat-intelligence guidance.
• Map network exposure: note any internet-facing or partner-accessible MOVEit Transfer instances, as unauthenticated access makes external reach especially dangerous.

How to remediate

Patch first. Apply the updates provided by the vendor for Progress MOVEit Transfer exactly as instructed in the official advisory. CISA requires organizations to apply updates per vendor instructions. After patching, verify the installation and restart services as directed.

For this SQL-injection class of weakness, follow standard hardening once the patch is in place: ensure the application and database accounts run with least privilege, restrict database permissions so the MOVEit service account cannot perform unnecessary schema changes or bulk data operations, and keep the underlying database engines patched. Review and tighten any custom integrations or scripts that interact with the MOVEit database. Re-test authentication and authorization controls after the update.

If you can't patch immediately

Reduce exposure until the vendor update can be applied. Segment MOVEit Transfer servers so they are reachable only from necessary internal networks or trusted partners; block direct internet access where possible. Deploy or tune a web application firewall (WAF) with virtual-patching rules that detect and block common SQL-injection patterns aimed at file-transfer interfaces—confirm rule efficacy against the vendor advisory and your own traffic baselines. If the product allows, temporarily disable any non-essential web or API features that accept unauthenticated input. Increase monitoring: enable detailed application and database logging, alert on anomalous query volumes or failed authentication spikes, and watch for ransomware-related indicators given the known use of this vulnerability. These controls lower risk but do not replace the patch.

If your data may have been exposed

Actively exploited vulnerabilities of this type, especially those with known ransomware use, frequently lead to data theft or encryption. If MOVEit Transfer was reachable and unpatched during the period of known exploitation, assume potential unauthorized database access and investigate accordingly—review logs, check for unexpected file transfers or account activity, and follow your incident-response plan. As a quick personal check, you can run a free exposure scan of your email address against known breach data sets to see whether associated credentials or personal information have already appeared in public dumps.