CVE-2023-34362: Critical SQL Injection in Progress MOVEit Transfer – Active Exploitation, Patch Guidance

Technical summary

CVE-2023-34362 is a pre-authentication SQL injection vulnerability (CWE-89) in the MOVEit Transfer web application. The flaw permits attackers to inject arbitrary SQL commands through an unvalidated input vector, circumventing role-based access controls. Exploitation can occur via standard HTTP or HTTPS requests. The vulnerability affects all versions prior to the patched releases: 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, and 2023.0.1. Legacy unsupported versions (2020.0, 2019.x, and earlier) remain vulnerable. Database-specific impacts include data exfiltration, unauthorized modification, and potential denial of service through record deletion.

Business impact

Organizations running unpatched MOVEit Transfer deployments face immediate risk of complete database compromise. Attackers can extract sensitive file metadata, user credentials, and transfer records without authentication. Given active exploitation in ransomware operations, affected organizations should treat this as a critical incident risk. Downtime required for emergency patching and forensic investigation can disrupt file transfer operations. Compliance implications include mandatory breach notification if customer data or personally identifiable information is accessed or exfiltrated.

Affected systems

Progress MOVEit Transfer (all versions prior to 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, and 2023.0.1) and Progress MOVEit Cloud are affected. This includes all legacy and unsupported versions dating back to at least 2019.x and 2020.0. The vulnerability is database-agnostic and exploitable regardless of whether the deployment uses MySQL, Microsoft SQL Server, or Azure SQL as the backend.

Exploitability

This vulnerability has reached operational maturity in the threat landscape. The CVSS 3.1 score of 9.8 (Critical) reflects the absence of authentication requirements (PR:N), low attack complexity (AC:L), and network accessibility (AV:N). Since early June 2023, active exploitation has been documented in the wild, including integration into ransomware attack chains. No user interaction or special network positioning is required; a simple HTTP/HTTPS request from the internet is sufficient to trigger the vulnerability. Organizations should assume their unpatched systems have been targeted.

Remediation

Organizations must immediately upgrade to patched versions: 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, or 2023.0.1 or later, depending on their current release track. For unsupported legacy versions, migration to a supported release is mandatory. Interim mitigations (network segmentation, WAF rules blocking SQL keywords) may reduce immediate risk but do not eliminate the vulnerability. After patching, conduct database integrity audits and review access logs for indicators of prior compromise.

Patch guidance

Apply the appropriate patch version corresponding to your current release track without delay. Progress has released fixes across five version families to accommodate diverse deployment scenarios. Verify patch application by confirming the installed version against the vendor advisory. If your organization operates an unsupported release (2020.0 or earlier), plan an emergency upgrade to 2023.0.1 or equivalent to ensure long-term supportability. Test patches in a non-production environment first, but given active exploitation, accelerate to production as quickly as risk assessment permits.

Detection guidance

Monitor MOVEit Transfer web server and database logs for SQL syntax patterns in HTTP request parameters and POST bodies (e.g., UNION, SELECT, DROP, INSERT). Examine database query logs for anomalous statements originating from the web application user account, particularly queries accessing system tables or credential stores. Network detection signatures should alert on HTTP requests containing encoded SQL keywords (e.g., %27, %3D) directed at MOVEit endpoints. Endpoint Detection & Response (EDR) tools should flag unexpected database access or command execution by the MOVEit service account.

Why prioritize this

This vulnerability merits immediate response due to its CVSS Critical rating (9.8), confirmed active exploitation in ransomware operations, lack of authentication requirements, and the sensitive nature of data typically stored in MOVEit Transfer databases. The vulnerability's presence on the KEV catalog and ransomware association further elevates incident risk. Organizations that have not patched should treat this as a security incident requiring emergency response protocols.

Risk score, explained

The 9.8 CVSS score reflects maximum severity across confidentiality, integrity, and availability (C:H/I:H/A:H), combined with unauthenticated network-based exploitability (AV:N/PR:N/AC:L/UI:N). No security controls short of patching can fully mitigate the risk. The score aligns with observed real-world exploitation, including ransomware campaigns, confirming the threat model's accuracy.

Frequently asked questions