# MA-943.062023: MyCERT Advisory - Multiple MOVEit Transfer Vulnerabilities

**Date:** 19 Jun 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-943.062023  
**Advisory ID:** MA-943.062023

---

**1.0 Introduction**
Recently, Progress has discovered a vulnerability in MOVEit Transfer that could lead to escalated privileges and potential unauthorized access to the environment. If you are a MOVEit Transfer customer, it is extremely important that you take immediate action as noted below in order to help protect your MOVEit Transfer environment. In Progress MOVEit Transfer versions released before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an un-authenticated attacker to gain unauthorized access to the MOVEit Transfer database.
**2.0 Impact**
A cyber threat actor could exploit this vulnerability to take over an affected system. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint which could result in modification and disclosure of MOVEit database content.
**3.0 Affected ProductsAll MOVEit Transfer versions are affected by this vulnerability.**
Based on our review of this situation to date, the following products are not susceptible to this SQL Injection Vulnerability in MOVEit Transfer: MOVEit Automation, MOVEit Client, MOVEit Add-in for Microsoft Outlook, MOVEit Mobile, WS\_FTP Client, WS\_FTP Server, MOVEit EZ, MOVEit Gateway, MOVEit Analytics, and MOVEit Freely. At this time, no action is necessary for the above-mentioned products.
**4.0 RecommendationsNOTICE: All MOVEit Transfer customers must take action and apply the patch to address the June 15th CVE-2023-35708 vulnerability discovered in MOVEit Transfer**. There are two paths to take depending on if you have applied the remediation and patching steps from the [MOVEit Transfer Critical Vulnerability (May 2023)](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023) article prior to June 15.
- **Have NOT applied May 2023 patch:** Follow all the remediation steps and patching in the following article: [MOVEit Transfer Critical Vulnerability (May 2023)](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023) . That article contains the latest patches, which includes the fix for the June 9 (CVE-2023-35036) vulnerability as well as the original vulnerability from May 31 (CVE-2023-34362). 
After you have done the above, proceed to the Immediate Mitigation Steps below.
- **Have applied May 2023 (CVE-2023-34362) patch and followed the remediation steps:** Proceed to the Immediate Mitigation Steps and apply the June 15 patch (CVE Pending) as outlined below. You will then be up to date for the vulnerabilities announced on May 31 (CVE-2023-34362), June 9 (CVE-2023-35036) and June 15 (CVE Pending).
- **Have applied May 2023 (CVE-2023-34362) patch, followed the remediation steps and applied the June 9 (CVE-2023-35036) patch:** Proceed to the Immediate Mitigation Steps and apply the June 15 patch (CVE-2023-35708) as outlined below. You will then be up to date for the vulnerabilities announced on May 31 (CVE-2023-34362), June 9 (CVE-2023-35036) and June 15 (CVE-2023-35708).
**5.0 Immediate Mitigation Steps**
To help prevent unauthorized access to your MOVEit Transfer environment, we strongly recommend that you immediately apply the following mitigation measures until you are able to apply the June 15th patch (CVE-2023-35708).
1. Disable all HTTP and HTTPs traffic to your MOVEit Transfer environment. More specifically:
- Modify firewall rules to deny HTTP and HTTPs traffic to MOVEit Transfer on ports 80 and 443.
- It is important to note that until HTTP and HTTPS traffic is enabled again:
- Users will not be able to log on to the MOVEit Transfer web UI
- MOVEit Automation tasks that use the native MOVEit Transfer host will not work
- REST, Java and .NET APIs will not work
- MOVEit Transfer add-in for Outlook will not work
- SFTP and FTP/s protocols will continue to work as normal
2. As a workaround, administrators will still be able to access MOVEit Transfer by using a remote desktop to access the Windows machine and then accessing <https://localhost/>. For more information on localhost connections, please refer to MOVEit Transfer Help: <https://docs.progress.com/bundle/moveit-transfer-web-admin-help-2023/page/Security-Policies-Remote-Access_2.html>
3. Apply the Patch 
As patches for supported MOVEit Transfer versions become available, links will be provided below. Supported versions are listed at the following link: <https://community.progress.com/s/products/moveit/product-lifecycle.> Please note, the license file can remain the same when staying on a major release to apply the patch.
4. Enable all HTTP and HTTPs traffic to your MOVEit Transfer environment
5. Please bookmark the [Progress Security Page](https://www.progress.com/security/moveit-transfer-and-moveit-cloud-vulnerability) and refer to it to ensure you have all of the latest updates.
**DLL Drop-In** (for customers who have one of the required versions listed installed)
IMPORTANT: Please read the README.txt before attempting the DLL Drop-in Install. Do not leave old versions of these DLL files on the system. They must be completely removed, not just renamed.
|  |
| --- | --- | --- | Required Version for DLL Drop-In | Fixed Version (DLL drop-in) | Documentation | MOVEit Transfer 2023.0.1, 2023.0.2 (15.0.1, 15.0.2) | [MOVEit Transfer 2023.0.3 (15.0.3)](https://cdn.ipswitch.com/ft/MOVEit/Transfer/2023/2023.0.3/MOVEitTransfer-2023.0.3-dropins.zip) | Download the patch at the link  in the Fixed Version column and  see the readme.txt file in the zip  file for instructions | MOVEit Transfer 2022.1.5, 2022.1.6 (14.1.5, 14.1.6) | [MOVEit Transfer 2022.1.7 (14.1.7)](https://cdn.ipswitch.com/ft/MOVEit/Transfer/2022/2022.1.7/MOVEitTransfer-2022.1.7-dropins.zip) | Download the patch at the link  in the Fixed Version column and  see the readme.txt file in the zip  file for instructions | MOVEit Transfer 2022.0.4, 2022.0.5 (14.0.4, 14.0.5) | [MOVEit Transfer 2022.0.6 (14.0.6)](https://cdn.ipswitch.com/ft/MOVEit/Transfer/2022/2022.0.6/MOVEitTransfer-2022.0.6-dropins.zip) | MOVEit Transfer 2021.1.4, 2021.1.5 (13.1.4, 13.1.5) | [MOVEit Transfer 2021.1.6 (13.1.6)](https://cdn.ipswitch.com/ft/MOVEit/Transfer/2021/2021.1.6/MOVEitTransfer-2021.1.6-dropins.zip) | Download the patch at the link  in the Fixed Version column and  see the readme.txt file in the zip  file for instructions | MOVEit Transfer 2021.0.6, 2021.0.7 (13.0.6, 13.0.7) | [MOVEit Transfer 2021.0.8 (13.0.8)](https://cdn.ipswitch.com/ft/MOVEit/Transfer/2021/2021.0.8/MOVEitTransfer-2021.0.8-dropins.zip) | MOVEit Transfer 2020.1.6 (12.1.6) or later | [MOVEit Transfer 2020.1.10 (12.1.10)](https://cdn.ipswitch.com/ft/MOVEit/Transfer/2020.1.10/MOVEitTransfer-2020.1.10-dropins.zip) | Download the patch at the link  in the Fixed Version column and  see the readme.txt file in the zip  file for instructions | MOVEit Transfer 2020.0.x (12.0) or older | MUST upgrade to a supported version | [See MOVEit Transfer Upgrade](https://community.progress.com/s/article/Upgrade-and-or-Migration-Guide-for-MOVEit-Automation-and-MOVEit-Transfer)  [and Migration Guide](http://and%20migration%20guide/) |
**Full Installer**
|  |
| --- | --- | --- | Affected Version | Fixed Version (full installer) | Documentation | MOVEit Transfer 2023.0.x (15.0.x) | [MOVEit Transfer 2023.03 (15.0.3)](https://cdn.ipswitch.com/ft/MOVEit/Transfer/2023/2023.0.3/MOVEit-Transfer-2023.0.3-FullInstall.exe) | [MOVEit 2023 Upgrade Documentation](https://docs.progress.com/category/moveit-transfer-2023) | MOVEit Transfer 2022.1.x (14.1.x) | [MOVEit Transfer 2022.1.7 (14.1.7)](https://cdn.ipswitch.com/ft/MOVEit/Transfer/2022/2022.1.7/MOVEit-Transfer-2022.1.7-FullInstall.exe) | [MOVEit 2022 Upgrade Documentation](https://docs.progress.com/category/moveit-transfer-2022) | MOVEit Transfer 2022.0.x (14.0.x) | [MOVEit Transfer 2022.0.6 (14.0.6)](https://cdn.ipswitch.com/ft/MOVEit/Transfer/2022/2022.0.6/MOVEit-Transfer-2022.0.6-FullInstall.exe) | MOVEit Transfer 2021.1.x (13.1.x) | [MOVEit Transfer 2021.1.6 (13.1.6)](https://cdn.ipswitch.com/ft/MOVEit/Transfer/2021/2021.1.6/MOVEit-Transfer-2021.1.6-FullInstall.exe) | [MOVEit 2021 Upgrade Documentation](https://docs.ipswitch.com/MOVEit/Transfer2021/Manuals/en/index.htm#90000.htm) | MOVEit Transfer 2021.0.x (13.0.x) | [MOVEit Transfer 2021.0.8 (13.0.8)](https://cdn.ipswitch.com/ft/MOVEit/Transfer/2021/2021.0.8/MOVEit-Transfer-2021.0.8-FullInstall.exe) | MOVEit Transfer 2020.1.x (12.1) | Must update to at least 2020.1.6 then apply DLL Drop-ins above | See KB?[Vulnerability (May 2023) Fix for MOVEit Transfer 2020.1 (12.1)](https://community.progress.com/s/article/Vulnerability-May-2023-Fix-for-MOVEit-Transfer-2020-1-12-1) | MOVEit Transfer 2020.0.x (12.0) or older | MUST upgrade to a supported version | [See MOVEit Transfer Upgrade and](https://community.progress.com/s/article/Upgrade-and-or-Migration-Guide-for-MOVEit-Automation-and-MOVEit-Transfer)  Migration Guide | MOVEit Cloud | Prod: 14.1.6.97 or 14.0.5.45  Test: 15.0.2.39 | All MOVEit Cloud systems are fully  patched at this time.  [Cloud Status Page](https://status.moveitcloud.com/) |
MyCERT urges users and organizations to review the [MOVEit Transfer Advisory](https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023), follow the mitigation steps, apply the necessary updates, and hunt for any malicious activity.
Kindly refer to the following URL: <https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**6.0    References**
- <https://www.cisa.gov/news-events/alerts/2023/06/01/progress-software-releases-security-advisory-moveit-transfer>
- <https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023>