MOVEit Customers Warned of Third Critical Vulnerability, Urged to Patch Immediately

Vulnerabilities in MOVEit Software Expose Customers to Unauthenticated Attacks

The Latest Vulnerability

Progress Software, the company behind the MOVEit file transfer software, has recently disclosed a third critical vulnerability in less than a month. Tracked as CVE-2023-35708, this vulnerability is an SQL injection flaw that could allow unauthenticated attackers to gain unauthorized access to the MOVEit Transfer database and escalate privileges. If exploited, this vulnerability could result in the modification and disclosure of sensitive database content.

Progress and Response

This critical vulnerability has prompted swift action from Progress Software, with patches available to address the issue. Progress states that the vulnerability is a result of a crafted payload submitted to a MOVEit Transfer application endpoint. The company has gone on record to criticize the way the bug was made public, stating that it did not follow normal industry standards.

Previous Vulnerabilities

This latest vulnerability marks the third critical SQL injection flaw patched by Progress in its MOVEit products in the span of three weeks. The first vulnerability, CVE-2023-34362, had been widely exploited since late May, and evidence suggested that exploitation may have started two years ago. The second vulnerability, CVE-2023-35036, was disclosed on June 9 but does not appear to have been exploited in the wild.

Impact and Attribution

The MOVEit vulnerabilities have had a significant impact, with over 100 organizations falling victim to attacks targeting the software. Victims include government agencies, transportation departments, energy organizations, media companies, and various others across multiple countries. The recent attacks have been attributed to the Cl0p ransomware gang.

Editorial: The Continued Challenge of Software Vulnerabilities

The Prevalence of Vulnerabilities

The discovery of multiple critical vulnerabilities in the MOVEit software highlights an ongoing issue facing the software industry. Despite efforts by organizations to develop secure software, vulnerabilities continue to be discovered and exploited by malicious actors. The MOVEit vulnerabilities serve as a reminder that no software is immune to security vulnerabilities, and ongoing efforts should be made to identify and address these flaws.

The Role of Responsible Disclosure

In the case of the MOVEit vulnerabilities, the way in which the bugs were made public has raised concerns. Progress Software criticized the lack of adherence to industry standards, indicating that responsible disclosure practices were not followed. Responsible disclosure ensures that software vendors have sufficient time to address vulnerabilities before they are made public, reducing the risk of exploitation. The MOVEit vulnerabilities demonstrate the importance of responsible disclosure and the potential consequences of not following these practices.

Advice: Addressing Vulnerabilities and Ensuring Software Security

Applying Patches

Customers using MOVEit Transfer should urgently apply the patches provided by Progress Software to address the critical vulnerabilities. These patches not only address the latest vulnerability (CVE-2023-35708) but also resolve previous vulnerabilities. Failure to apply these patches could expose organizations to potential attacks. It is essential for customers to prioritize patching and ensure that all available updates are applied promptly.

Implementing Security Measures

In addition to patching, organizations should take further measures to enhance the security of their MOVEit Transfer environment. Progress Software advises disabling HTTP and HTTPS traffic, allowing only localhost access, while patches are being applied. Once the patches are installed, HTTP and HTTPS traffic can be re-enabled. These measures can restrict unauthorized access to the software and minimize the risk of exploitation.

Promoting Responsible Disclosures

To address vulnerabilities effectively, industry-wide cooperation is vital. Software vendors, security researchers, and the wider cybersecurity community should work together to encourage responsible disclosure. This includes following established guidelines and industry best practices for disclosing vulnerabilities, providing vendors with adequate time to develop and release patches before public disclosure is made. By promoting responsible disclosure, the overall security landscape can be improved, leading to more secure software and reduced risks for organizations and users.

Conclusion

The vulnerabilities discovered in MOVEit Transfer software serve as a reminder of the ongoing challenges faced by the software industry in maintaining secure systems. Organizations must remain vigilant and proactive in addressing vulnerabilities as they are discovered. By promptly applying patches, enhancing security measures, and promoting responsible disclosure, software vendors and users can work together to create a safer digital environment.