{"slug":"moveit-transfer","title":"MOVEit Transfer (CVE-2023-34362)","shortName":"MOVEit Transfer","summary":"Unauthenticated SQL injection in Progress MOVEit Transfer leading to database access and LEMURLOOT webshell deployment. CVSS 9.8. Mass exploitation by CL0P / FIN11 from 27 May 2023. Listed in CISA KEV on 2 Jun 2023.","isExample":false,"draft":false,"family":"moveit-transfer","kind":"single-product","aliases":["CVE-2023-34362","LEMURLOOT","CL0P MOVEit"],"publishedAt":"2023-05-31","updatedAt":"2026-10-24","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2023-34362","cvss":{"cve":"CVE-2023-34362","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"nvd","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-34362","sourceDate":"2026-06-17","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2023-34362","score":0.99934,"percentile":0.99971,"date":"2026-10-23","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2023-34362","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2023-34362","listed":true,"dateAdded":"2023-06-02","dueDate":"2023-06-23","catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated SQL injection in Progress MOVEit Transfer (CVE-2023-34362) used by CL0P to steal files and plant the LEMURLOOT webshell. Listed in CISA KEV.","action":"Confirm MOVEit Transfer is on a fixed release and hunt for LEMURLOOT and rogue admin accounts on any host that was internet-facing in May 2023."},"seenInTheWild":[{"metric":"exposed","value":"over 3,000 hosts exposed","observer":"Censys","date":"2023-06-02","method":"Hosts running MOVEit Transfer; version not determinable","sourceUrl":"https://censys.com/blog/moveit-transfer/"},{"metric":"exposed","value":942,"observer":"Shodan","date":"2026-10-23","method":"Product query http.title:\"MOVEit\"","sourceUrl":"https://www.shodan.io/search?query=http.title%3A%22MOVEit%22","note":"Exposed hosts. Data: Shodan."},{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2023-06-02","method":"CISA Known Exploited Vulnerabilities catalog dateAdded","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"seenInTheWildLinks":[{"title":"MOVEit CVE-2023-34362 Attempt","url":"https://viz.greynoise.io/tags/moveit-cve-2023-34362-attempt","observer":"GreyNoise","metric":"scanning"},{"title":"MOVEit Transfer Scanner","url":"https://viz.greynoise.io/tags/moveit-transfer-scanner","observer":"GreyNoise","metric":"scanning"}],"whatChanged":{"date":"2026-10-24","items":[{"text":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","section":"priority","addedDate":"2026-10-24"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","section":"detection","addedDate":"2026-10-24"}]},"whatTheBugIs":"CVE-2023-34362 is a SQL injection vulnerability in the Progress MOVEit Transfer web application. NVD scores it CVSS 3.1 9.8. An unauthenticated attacker can gain access to the MOVEit Transfer database and, depending on the database engine, escalate to remote code execution and install a webshell.\n\nProgress announced the issue on 31 May 2023. Mandiant's earliest evidence of exploitation is 27 May 2023. The CL0P ransomware gang (TA505 / FIN11) deployed a webshell named LEMURLOOT, often as human2.aspx, after SQLi against guestaccess.aspx, then stole files from MOVEit databases and sometimes Azure Blob configuration.\n\nAffected versions before the May 2023 fixes include MOVEit Transfer before 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), and 2023.0.1 (15.0.1).","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"sqli","label":"SQL injection","detail":"Unauthenticated SQL injection hits the internet-facing MOVEit Transfer web app (observed via guestaccess.aspx)."},{"id":"db","label":"Database access","detail":"Attacker reads or manipulates the MOVEit database and application settings."},{"id":"shell","label":"LEMURLOOT webshell","detail":"A webshell masquerading as human.aspx / human2.aspx is written to the web root."},{"id":"theft","label":"Data theft","detail":"Files and Azure Blob settings are exfiltrated for extortion. Conceptual impact class only."}]},"exploitation":{"kev":{"listed":true,"date":"2023-06-02","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV entry for CVE-2023-34362, Progress MOVEit Transfer SQL Injection Vulnerability. dateAdded 2023-06-02. knownRansomwareCampaignUse Known."},"firstSeen":{"date":"2023-05-27","source":"Mandiant","note":"Based on Mandiant incident response engagements, the earliest evidence of exploitation occurred on 27 May 2023."},"vendorStatements":[{"vendor":"Progress Software","date":"2023-05-31","statement":"Progress announced a critical SQL injection vulnerability in MOVEit Transfer (CVE-2023-34362) and published remediation guidance.","url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023","retracted":false},{"vendor":"Mandiant","date":"2023-06-02","statement":"Mandiant has observed wide exploitation of a zero-day vulnerability in MOVEit Transfer... earliest evidence of exploitation occurred on May 27, 2023 resulting in deployment of web shells and data theft.","url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","retracted":false},{"vendor":"CISA / FBI","date":"2023-06-07","statement":"Beginning on May 27, 2023, CL0P Ransomware Gang, also known as TA505, began exploiting a previously unknown SQL injection vulnerability in MOVEit Transfer. Internet-facing MOVEit Transfer web applications were infected with a web shell named LEMURLOOT.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","retracted":false}]},"timeline":[{"date":"2023-05-27","event":"Mandiant and CISA/FBI date the start of CL0P mass exploitation.","source":{"title":"Zero-Day Vulnerability in MOVEit Transfer Exploited for Data Theft","url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","publisher":"Mandiant"},"kind":"exploited","key":true},{"date":"2023-05-31","event":"Progress publishes the critical MOVEit Transfer advisory and patches.","source":{"title":"MOVEit Transfer Critical Vulnerability","url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023","publisher":"Progress Software"},"kind":"patch","key":true},{"date":"2023-06-02","event":"CVE-2023-34362 published. CISA adds it to KEV. Mandiant publishes its analysis.","source":{"title":"NVD CVE-2023-34362","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34362","publisher":"NVD"},"kind":"kev","key":true},{"date":"2023-06-07","event":"CISA and FBI release joint CSA AA23-158a on CL0P exploitation of MOVEit.","source":{"title":"#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","publisher":"CISA"},"kind":"advisory","key":true},{"date":"2023-06-09","event":"Horizon3 publishes a public PoC repository for CVE-2023-34362.","source":{"title":"horizon3ai/CVE-2023-34362","url":"https://github.com/horizon3ai/CVE-2023-34362","publisher":"Horizon3"},"kind":"poc","key":true}],"defenderActions":[{"title":"Apply Progress MOVEit Transfer patches","detail":"Upgrade to the fixed releases Progress lists for your train (2021.0.6 / 2021.1.4 / 2022.0.4 / 2022.1.5 / 2023.0.1 or later). Follow Progress's remediation and hardening guidance.","priority":"now","links":[{"label":"Progress MOVEit advisory","href":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023"}]},{"title":"Remove internet exposure until patched and cleaned","detail":"CISA/FBI recommend mitigating internet-facing MOVEit Transfer instances immediately, including taking the web UI offline while patching and investigating.","priority":"now","links":[{"label":"CISA AA23-158a","href":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a"}]},{"title":"Hunt for LEMURLOOT and rogue admin accounts","detail":"Search the web root for human2.aspx / _human2.aspx and similar masquerades of human.aspx. Review accounts with RealName/LoginName Health Check Service and unexpected session records.","priority":"soon","links":[{"label":"Mandiant MOVEit analysis","href":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft"}]},{"title":"Assume data theft and rotate credentials","detail":"Mandiant observed file theft within minutes of webshell deployment, including Azure Blob settings. Rotate credentials, review exfiltration, and follow incident-response playbooks for extortion events.","priority":"soon"}],"detection":[{"title":"SQLi traffic to guestaccess.aspx","detail":"Mandiant observed several POST requests to the legitimate guestaccess.aspx file before LEMURLOOT interaction, indicating SQL injection directed at that file.","logSource":"Web access logs / reverse-proxy logs / IIS logs","kind":"generic","group":"web-proxy"},{"title":"LEMURLOOT X-siLock-* headers","detail":"LEMURLOOT authenticates with a header field X-siLock-Comment carrying a 36-character GUID and accepts tasking via X-siLock-Step1 / Step2 / Step3 headers.","logSource":"Web access logs / reverse-proxy logs / IIS logs","kind":"generic","group":"web-proxy"},{"title":"human2.aspx webshell files","detail":"Samples named human2.aspx and _human2.aspx were observed on disk and on VirusTotal beginning 28 May 2023.","logSource":"EDR / process telemetry","kind":"generic","group":"edr"},{"title":"Akamai App & API Protector: SQL injection attack group","detail":"Akamai states the Adaptive Security Engine SQL injection attack group blocks CVE-2023-34362 exploitation. No dedicated rule ID published.","logSource":"Akamai Security Events (WAF) logs","kind":"vendor-signature","url":"https://www.akamai.com/blog/security-research/moveit-sqli-zero-day-exploit-clop-ransomware","date":"2023-06-08"},{"title":"NetScaler WAF signature: 998690","detail":"NetScaler WAF signature update version 106: rule 998690 (WEB-MISC Progress MOVEit Transfer SQL injection) for CVE-2023-34362.","logSource":"NetScaler WAF (AppFw) logs","kind":"vendor-signature","url":"https://docs.netscaler.com/en-us/citrix-adc/13-1/signature-alerts/signature-update-version-106.html","date":"2026-10-23","dateKind":"checked"},{"title":"F5 attack signature: 200013058","detail":"MOVEit Transfer Privilege Escalation (200013058), references CVE-2023-34362, last update 2023-06-15.","logSource":"F5 Advanced WAF / Distributed Cloud WAF event logs","kind":"vendor-signature","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2023-06-15"},{"title":"Fastly Next-Gen WAF: virtual patch CVE-2023-34362","detail":"Virtual patch CVE-2023-34362 added 2023-06-12.","logSource":"Fastly Next-Gen WAF signal logs","kind":"vendor-signature","url":"https://www.fastly.com/documentation/reference/changes/2023/06/added-virtual-patch-for-cve-2023-34362/","date":"2023-06-12"},{"title":"Fortinet FortiWeb: 1090501763","detail":"FortiWeb signature Progress.MOVEit.Transfer.Unrestricted.File.Upload (1090501763), 2023-06-15. FortiADC WAF 1002017318 also listed.","logSource":"FortiWeb attack logs","kind":"vendor-signature","url":"https://www.fortiguard.com/outbreak-alert/progress-moveit-transfer-sql-injection","date":"2026-10-23","dateKind":"checked"},{"title":"Imperva Cloud WAF / WAF Gateway: SQLi signatures","detail":"Imperva states CVE-2023-34362 is mitigated by Cloud WAF, WAF Gateway and RASP. No rule IDs published.","logSource":"WAF event logs","kind":"vendor-signature","url":"https://www.imperva.com/blog/cve-2023-34362-moveit-transfer/","date":"2023-06-06"},{"title":"Check Point IPS: CPAI-2023-0386","detail":"Protection 'Progress MOVEit Transfer SQL Injection', published 2023-06-04, for CVE-2023-34362.","logSource":"Check Point IPS logs (SmartConsole / Logs & Monitor)","kind":"vendor-signature","url":"https://advisories.checkpoint.com/defense/advisories/public/2023/cpai-2023-0386.html/","date":"2023-06-04"},{"title":"Cisco Talos Snort: 1:61876-61879, Snort 3 300582-300583","detail":"Released 2023-06-02 for MOVEit webshell activity. Rule doc 1:61876 references CVE-2023-34362.","logSource":"Snort / Cisco Secure Firewall IPS event logs","kind":"vendor-signature","url":"https://www.snort.org/advisories/talos-rules-2023-06-02","date":"2023-06-02"},{"title":"Fortinet FortiGuard IPS: 53240","detail":"IPS signature Progress.MOVEit.Transfer.Unrestricted.File.Upload (53240), 2023-06-05.","logSource":"FortiGate IPS logs","kind":"vendor-signature","url":"https://www.fortiguard.com/search?q=CVE-2023-34362&engine=1","date":"2023-06-15"},{"title":"Juniper IDP: HTTP:SQL:INJ:PROGRESS-MOVEIT-2","detail":"IDP signature for CVE-2023-34362 / CVE-2023-36932, release date 2023-08-10, recommended action Drop.","logSource":"Juniper SRX IDP logs","kind":"vendor-signature","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:SQL:INJ:PROGRESS-MOVEIT-2.html","date":"2023-08-10"},{"title":"Palo Alto Networks Threat Prevention: 93976 / 93977","detail":"Threat IDs 93976 and 93977 for CVE-2023-34362 per Unit 42 threat brief.","logSource":"Palo Alto Networks threat logs (Threat Prevention / NGFW)","kind":"vendor-signature","url":"https://unit42.paloaltonetworks.com/threat-brief-moveit-cve-2023-34362/","date":"2023-10-04"},{"title":"Sophos Firewall IPS: MOVEit human2.aspx webshell signatures 60597-60600","detail":"IPS release 18.24.96 (2026-06-03) lists MOVEit human2.aspx webshell request, response and upload signatures referencing CVE-2023-34362. Older Sophos IPS notes for 2023 are not online.","logSource":"Sophos Firewall IPS logs","kind":"vendor-signature","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.24.96.html","date":"2026-06-03"},{"title":"Trend Micro Deep Security 1011774, TippingPoint 42808 / 42811","detail":"Deep Security IPS rule 1011774. TippingPoint 42808 'HTTP: MOVEit Transfer SQL Injection Vulnerability' and 42811 'MOVEitISAPI.dll Endpoint Access'.","logSource":"Trend Micro Deep Security / TippingPoint SMS event logs","kind":"vendor-signature","url":"https://success.trendmicro.com/en-US/solution/KA-0014759","date":"2026-10-23","dateKind":"checked"},{"title":"Cato IPS: CVE-2023-34362 virtual patch","detail":"Cato IPS virtual patch. Opt-in protection 2023-06-08, global protection 2023-06-09. No rule ID published.","logSource":"Cato Networks IPS events","kind":"vendor-signature","url":"https://www.catonetworks.com/blog/cato-protects-against-moveit-vulnerability-cve-2023-34362/","date":"2026-10-23"},{"title":"Netskope IPS: 61936 / 62231","detail":"Netskope Threat Labs IPS library lists SERVER-WEBAPP MOVEit Transfer moveitisapi.dll SSRF (61936) and SQL injection (62231) with CVE-2023-34362. Library pages are undated.","logSource":"Netskope Cloud Firewall / IPS alert logs","kind":"vendor-signature","url":"https://threatlabs.netskope.com/library/ips/server-webapp-moveit-transfer-moveitisapi-dll-sql-injection-attempt/","date":"2026-10-23","dateKind":"checked"},{"title":"Zscaler ATP: *.EXPLOIT.CVE-2023-34362, ZPA AppProtection 6000662","detail":"ATP signatures WIN32.EXPLOIT.CVE-2023-34362, APP.EXPLOIT.CVE-2023-34362, HTML.EXPLOIT.CVE-2023-34362. ZPA AppProtection rule 6000662 (moveitisapi SQL injection).","logSource":"Zscaler ZIA web / threat logs; ZPA AppProtection logs","kind":"vendor-signature","url":"https://www.zscaler.com/blogs/security-research/coverage-advisory-cve-2023-34362-moveit-transfer-vulnerabilities","date":"2023-06-09"}],"detectionRules":[{"id":"sigma-moveit-webshell-request","title":"MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request","language":"sigma","query":"title: MOVEit CVE-2023-34362 Exploitation Attempt - Potential Web Shell Request\nid: 435e41f2-48eb-4c95-8a2b-ed24b50ec30b\nstatus: test\ndescription: Detects get requests to specific files used during the exploitation of MOVEit CVE-2023-34362\nreferences:\n    - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023\n    - https://www.mandiant.com/resources/blog/zero-day-moveit-data-theft\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-06-03\nmodified: 2023-07-28\ntags:\n    - attack.persistence\n    - attack.t1505.003\n    - cve.2023-34362\n    - detection.emerging-threats\nlogsource:\n    category: webserver\ndetection:\n    selection:\n        cs-method: 'GET'\n        cs-uri-stem|contains:\n            - '/human2.aspx'\n            - '/_human2.aspx'\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: high","logSource":"IIS W3C logs","author":"Nasreddine Bencherchali (Nextron Systems)","authorUrl":"https://github.com/SigmaHQ/sigma","sourceUrl":"https://github.com/SigmaHQ/sigma/blob/05d1031f537e830b76da53bae2400c5814c89165/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/web_cve_2023_34362_known_payload_request.yml.yml","sourceDate":"2023-07-28","license":"DRL-1.1","origin":"community","tested":"untested"},{"id":"sigma-moveit-file-activity","title":"Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity","language":"sigma","query":"title: Potential MOVEit Transfer CVE-2023-34362 Exploitation - File Activity\nid: c3b2a774-3152-4989-83c1-7afc48fd1599\nstatus: test\ndescription: Detects file indicators of potential exploitation of MOVEit CVE-2023-34362.\nreferences:\n    - https://www.bleepingcomputer.com/news/security/new-moveit-transfer-zero-day-mass-exploited-in-data-theft-attacks/\n    - https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023\n    - https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/\n    - https://www.reddit.com/r/sysadmin/comments/13wxuej/comment/jmhdg55/\nauthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-06-01\nmodified: 2024-08-13\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - cve.2023-34362\n    - detection.emerging-threats\nlogsource:\n    category: file_event\n    product: windows\ndetection:\n    selection_generic:\n        TargetFilename|contains:\n            - '\\MOVEit Transfer\\wwwroot\\'\n            - '\\MOVEitTransfer\\wwwroot\\'\n        TargetFilename|endswith:\n            - '.7z'\n            - '.bat'\n            - '.dll'\n            - '.exe'\n            - '.ps1'\n            - '.rar'\n            - '.vbe'\n            - '.vbs'\n            - '.zip'\n    selection_known_ioc:\n        TargetFilename|endswith:\n            - '\\MOVEit Transfer\\wwwroot\\_human2.aspx.lnk'\n            - '\\MOVEit Transfer\\wwwroot\\_human2.aspx'\n            - '\\MOVEit Transfer\\wwwroot\\human2.aspx.lnk'\n            - '\\MOVEit Transfer\\wwwroot\\human2.aspx'\n            - '\\MOVEitTransfer\\wwwroot\\_human2.aspx.lnk'\n            - '\\MOVEitTransfer\\wwwroot\\_human2.aspx'\n            - '\\MOVEitTransfer\\wwwroot\\human2.aspx.lnk'\n            - '\\MOVEitTransfer\\wwwroot\\human2.aspx'\n    # Uncomment selection if you wanna threat hunt for additional artifacts\n    # selection_cmdline:\n    #    TargetFilename|contains: ':\\Windows\\TEMP\\'\n    #    TargetFilename|endswith: '.cmdline'\n    selection_compiled_asp:\n        CreationUtcTime|startswith:\n            - '2023-03- '\n            - '2023-04- '\n            - '2023-05- '\n            - '2023-06- '\n        TargetFilename|contains|all:\n            - '\\Windows\\Microsoft.net\\Framework64\\v'\n            - '\\Temporary ASP.NET Files\\'\n            - 'App_Web_'\n        TargetFilename|endswith: '.dll'\n    condition: 1 of selection_*\nfalsepositives:\n    - To avoid FP, this rule should only be applied on MOVEit servers.\nlevel: high","logSource":"Windows file creation (Sysmon 11)","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","authorUrl":"https://github.com/SigmaHQ/sigma","sourceUrl":"https://github.com/SigmaHQ/sigma/blob/05d1031f537e830b76da53bae2400c5814c89165/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/file_event_win_exploit_cve_2023_34362_moveit_transfer.yml","sourceDate":"2024-08-13","license":"DRL-1.1","origin":"community","tested":"untested"},{"id":"sigma-moveit-w3wp-csc","title":"Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE","language":"sigma","query":"title: Potential MOVEit Transfer CVE-2023-34362 Exploitation - Dynamic Compilation Via Csc.EXE\nid: 39ac1fb0-07f1-474b-b97e-c5c0eace0d79\nstatus: test\ndescription: |\n    Detects the execution of \"csc.exe\" via \"w3wp.exe\" process. MOVEit affected hosts execute \"csc.exe\" via the \"w3wp.exe\" process to dynamically compile malicious DLL files.\n\n    MOVEit is affected by a critical vulnerability. Exploited hosts show evidence of dynamically compiling a DLL and writing it under C:\\\\Windows\\\\Microsoft\\.NET\\\\Framework64\\\\v4\\.0\\.30319\\\\Temporary ASP\\.NET Files\\\\root\\\\([a-z0-9]{5,12})\\\\([a-z0-9]{5,12})\\\\App_Web_[a-z0-9]{5,12}\\.dll.\n\n    Hunting Opportunity\n\n    Events from IIS dynamically compiling binaries via the csc.exe on behalf of the MOVEit application, especially since May 27th should be investigated.\nreferences:\n    - https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response\n    - https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/\nauthor: '@kostastsale'\ndate: 2023-06-01\ntags:\n    - attack.execution\n    - attack.t1059\n    - cve.2023-34362\n    - detection.emerging-threats\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        ParentImage|endswith: '\\w3wp.exe'\n        ParentCommandLine|contains: 'moveitdmz pool'\n        Image|endswith: '\\csc.exe'\n    condition: selection\nfalsepositives:\n    - Initial software installation and software updates.\nlevel: medium","logSource":"Windows process creation (Sysmon 1 / 4688)","author":"@kostastsale","authorUrl":"https://github.com/SigmaHQ/sigma","sourceUrl":"https://github.com/SigmaHQ/sigma/blob/05d1031f537e830b76da53bae2400c5814c89165/rules-emerging-threats/2023/Exploits/CVE-2023-34362-MOVEit-Transfer-Exploit/proc_creation_win_exploit_cve_2023_34362_moveit_transfer_exploitation_activity.yml","sourceDate":"2023-06-01","license":"DRL-1.1","origin":"community","tested":"untested"},{"id":"splunk-moveit-writing-aspx","title":"Windows MOVEit Transfer Writing ASPX","language":"spl","query":"| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\nas lastTime FROM datamodel=Endpoint.Filesystem where\n  Filesystem.file_path IN (\"*\\\\MOVEitTransfer\\\\wwwroot\\\\*\") AND\n  Filesystem.file_name IN(\"*.ashx\", \"*.asp*\")\nby Filesystem.action Filesystem.dest Filesystem.file_access_time Filesystem.file_create_time\nFilesystem.file_hash Filesystem.file_modify_time Filesystem.file_name Filesystem.file_path\nFilesystem.file_acl Filesystem.file_size Filesystem.process_guid Filesystem.process_id\nFilesystem.user Filesystem.vendor_product\n| `drop_dm_object_name(Filesystem)`\n| `security_content_ctime(firstTime)`\n| `security_content_ctime(lastTime)`\n| `windows_moveit_transfer_writing_aspx_filter`","logSource":"Sysmon EventID 11 (Endpoint.Filesystem data model)","author":"Michael Haag, Splunk","authorUrl":"https://research.splunk.com/","sourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/endpoint/windows_moveit_transfer_writing_aspx.yml","sourceDate":"2026-05-13","license":"Apache-2.0","origin":"vendor","notes":"Uses Splunk ES macros and data models from splunk/security_content; the trailing _filter macro is a tuning hook.","tested":"tested","testedNote":"Splunk security_content YAML includes a True Positive Test and status production.","testedSourceUrl":"https://github.com/splunk/security_content/blob/7aafb1e3bc6bbe2b49bcf7d4fed029a5ea7e871c/detections/endpoint/windows_moveit_transfer_writing_aspx.yml"},{"id":"et-moveit-guestaccess-sqli-stage2","title":"ET WEB_SPECIFIC_APPS MOVEit File Transfer - Trigger SQL Injection via guestaccess.aspx - CVE-2023-34362 Stage 2","language":"suricata","query":"alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:\"ET WEB_SPECIFIC_APPS MOVEit File Transfer - Trigger SQL Injection via guestaccess.aspx - CVE-2023-34362 Stage 2\"; flow:established,to_server; http.method; content:\"POST\"; http.uri; content:\"/guestaccess.aspx\"; fast_pattern; http.request_body; content:\"transaction\"; nocase; content:\"secmsgpost\"; within:20; content:\"CsrfToken\"; nocase; reference:url,www.horizon3.ai/moveit-transfer-cve-2023-34362-deep-dive-and-indicators-of-compromise/; reference:url,attackerkb.com/topics/mXmV0YpC3W/cve-2023-34362/rapid7-analysis; reference:cve,2023-34362; classtype:attempted-admin; sid:2046192; rev:1; metadata:attack_target Web_Server, created_at 2023_06_12, cve CVE_2023_34362, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag CISA_KEV, updated_at 2023_06_12, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)","logSource":"Suricata IDS alerts (ET Open ruleset)","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-web_specific_apps.rules","sourceDate":"2023-06-12","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","notes":"Needs decrypted HTTP to MOVEit.","tested":"untested"},{"id":"yara-moveit-aspx-webshell","title":"WEBSHELL_ASPX_MOVEit_Jun23_1","language":"yara","query":"rule WEBSHELL_ASPX_MOVEit_Jun23_1 {\n   meta:\n      description = \"Detects ASPX web shells as being used in MOVEit Transfer exploitation\"\n      author = \"Florian Roth\"\n      reference = \"https://www.rapid7.com/blog/post/2023/06/01/rapid7-observed-exploitation-of-critical-moveit-transfer-vulnerability/\"\n      date = \"2023-06-01\"\n      score = 85\n      hash1 = \"2413b5d0750c23b07999ec33a5b4930be224b661aaf290a0118db803f31acbc5\"\n      hash2 = \"48367d94ccb4411f15d7ef9c455c92125f3ad812f2363c4d2e949ce1b615429a\"\n      hash3 = \"e8012a15b6f6b404a33f293205b602ece486d01337b8b3ec331cd99ccadb562e\"\n      id = \"2c789b9c-5ec5-5fd1-84e3-6bf7735a9488\"\n   strings:\n      $s1 = \"X-siLock-Comment\" ascii fullword   \n      $s2 = \"]; string x = null;\" ascii\n      $s3 = \";  if (!String.Equals(pass, \" ascii\n   condition:\n      filesize < 150KB and 2 of them\n}","logSource":"Files under the MOVEit wwwroot (YARA scan)","author":"Florian Roth","authorUrl":"https://github.com/Neo23x0/signature-base","sourceUrl":"https://github.com/Neo23x0/signature-base/blob/3ce6640c26046da8e6d8094af3eaaee3ee84e648/yara/vuln_moveit_0day_jun23.yar","sourceDate":"2023-06-01","license":"DRL-1.1","origin":"community","tested":"untested"},{"id":"v2s-kql-moveit-human2-requests","title":"Requests to the human2.aspx web shell (IIS logs in Sentinel)","language":"kql","query":"W3CIISLog\n| where TimeGenerated > ago(30d)\n| where csUriStem has_any (\"/human2.aspx\", \"/_human2.aspx\")\n| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by cIP, csMethod, csUriStem, scStatus","logSource":"IIS W3C logs in Microsoft Sentinel (W3CIISLog)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","sourceDate":"2023-06-02","license":"CC0 1.0","origin":"vuln2shell","notes":"Mandiant and Progress name human2.aspx and _human2.aspx as the LEMURLOOT web shell files.","tested":"untested"},{"id":"v2s-logscale-moveit-human2-write","title":"human2.aspx written on a MOVEit server (Falcon)","language":"logscale","query":"#event_simpleName=/^(NewScriptWritten|WebScriptFileWritten)$/ event_platform=Win\n| FileName=/^_?human2\\.aspx$/i\n| groupBy([aid, ComputerName, TargetFileName], limit=max)","logSource":"CrowdStrike Falcon NewScriptWritten / WebScriptFileWritten (Windows)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","sourceDate":"2023-06-02","license":"CC0 1.0","origin":"vuln2shell","notes":"Same file names as the Mandiant and SigmaHQ rules. Event names follow the CrowdStrike ToolShell community query.","tested":"untested"}],"detectionLinks":[{"title":"CISA and FBI advisory AA23-158A (CL0P MOVEit)","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","author":"CISA, FBI","date":"2023-06-07","note":"IOCs and YARA in the advisory."},{"title":"Mandiant: Zero-day vulnerability in MOVEit Transfer exploited for data theft","url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","author":"Mandiant","date":"2023-06-02"},{"title":"signature-base: MOVEit log indicator YARA rules","url":"https://github.com/Neo23x0/signature-base/blob/3ce6640c26046da8e6d8094af3eaaee3ee84e648/yara/vuln_moveit_0day_jun23.yar","author":"Florian Roth, Nasreddine Bencherchali","date":"2023-06-13","note":"LOG_EXPL_MOVEit_Exploitation_Indicator_Jun23_1 to _3 scan MOVEit logs."},{"title":"ET Open MOVEit staged rules (sids 2046188 to 2046198)","url":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-web_specific_apps.rules","author":"Emerging Threats","date":"2024-04-27"}],"retrohunt":{"summary":"Search IIS logs back to at least 27 May 2023, and to July 2021 if you have them, for human2.aspx, guestaccess.aspx POST bursts and X-siLock headers. Check the web root and the database for the LEMURLOOT webshell and the Health Check Service account.","lookback":{"from":"2021-07-06","basis":"first-attempt","rationale":"Mandiant dates the earliest exploitation to 27 May 2023. Kroll found activity consistent with MOVEit exploitation in client IIS logs on 27 Apr 2022 and between 6 and 18 Jul 2021, which it read as testing. Mass theft starts 27 May 2023; testing traces can go back to July 2021.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","date":"2023-06-02","publisher":"Mandiant"},{"url":"https://www.kroll.com/en/insights/publications/cyber/clop-ransomware-moveit-transfer-vulnerability-cve-2023-34362","date":"2023-06-08","publisher":"Kroll"}]},"logSources":[{"name":"IIS W3C logs on the MOVEit server","why":"All exploit, webshell and theft requests go through IIS.","required":true},{"name":"MOVEit Transfer database and audit logs","why":"Rogue sessions and the Health Check Service user live here.","required":true},{"name":"File events under the MOVEit wwwroot","why":"human2.aspx and its temporary compiled DLLs are written to disk.","required":true},{"name":"Egress / firewall logs","why":"Large outbound transfers show what was taken.","required":false}],"steps":[{"title":"Search IIS logs for the webshell","detail":"Look for GET or POST to /human2.aspx or /_human2.aspx. A 200 from an external IP is serious.","sources":[{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","date":"2023-06-07","publisher":"CISA and FBI"}]},{"title":"Look for SQL injection against guestaccess.aspx","detail":"Mandiant saw several POSTs to guestaccess.aspx before LEMURLOOT use. Kroll found the same pattern in older logs.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","date":"2023-06-02","publisher":"Mandiant"},{"url":"https://www.kroll.com/en/insights/publications/cyber/clop-ransomware-moveit-transfer-vulnerability-cve-2023-34362","date":"2023-06-08","publisher":"Kroll"}]},{"title":"Check request headers if you log them","detail":"LEMURLOOT authenticates with an X-siLock-Comment header and takes tasking in X-siLock-Step1, Step2 and Step3.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","date":"2023-06-02","publisher":"Mandiant"}]},{"title":"Check the database for rogue accounts","detail":"Look for an account with the name Health Check Service and for unexpected sessions.","sources":[{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","date":"2023-06-07","publisher":"CISA and FBI"}]},{"title":"Size the theft","detail":"Mandiant saw file theft within minutes of webshell deployment. Review download volumes and Azure Blob settings access.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","date":"2023-06-02","publisher":"Mandiant"}]}],"queries":[{"id":"v2s-rh-kql-moveit-retrohunt","title":"MOVEit webshell and guestaccess POSTs since July 2021","language":"kql","query":"W3CIISLog\n| where TimeGenerated >= datetime(2021-07-06)\n| where csUriStem has_any (\"/human2.aspx\", \"/_human2.aspx\", \"/guestaccess.aspx\", \"/moveitisapi/moveitisapi.dll\")\n| summarize Count = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by cIP, csMethod, csUriStem, scStatus\n| order by FirstSeen asc","logSource":"IIS W3C logs in Microsoft Sentinel (W3CIISLog)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.kroll.com/en/insights/publications/cyber/clop-ransomware-moveit-transfer-vulnerability-cve-2023-34362","sourceDate":"2023-06-08","license":"CC0 1.0","origin":"vuln2shell","notes":"guestaccess.aspx and moveitisapi.dll are legitimate; look for POST bursts from one external IP. human2.aspx is never legitimate.","tested":"untested","timeRange":"From 2021-07-06, limited by retention"},{"id":"v2s-rh-spl-moveit-retrohunt","title":"MOVEit webshell and guestaccess POSTs since July 2021","language":"spl","query":"index=* sourcetype=ms:iis:* earliest=\"07/06/2021:00:00:00\"\n(cs_uri_stem=\"*/human2.aspx\" OR cs_uri_stem=\"*/_human2.aspx\" OR (cs_method=POST cs_uri_stem=\"*/guestaccess.aspx\"))\n| stats count min(_time) as firstTime max(_time) as lastTime by c_ip, cs_method, cs_uri_stem, sc_status\n| convert ctime(firstTime) ctime(lastTime)","logSource":"IIS logs in Splunk (Splunk Add-on for Microsoft IIS field names)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","sourceDate":"2023-06-02","license":"CC0 1.0","origin":"vuln2shell","notes":"Adjust field names if your IIS sourcetype differs.","tested":"untested","timeRange":"From 2021-07-06"},{"id":"v2s-rh-logscale-moveit-retrohunt","title":"MOVEit webshell requests in IIS logs","language":"logscale","query":"// Set the time picker to start 2021-07-06\n/\\/_?human2\\.aspx|X-siLock-Comment/i\n| groupBy([#host], function=[count(), min(@timestamp, as=firstSeen), max(@timestamp, as=lastSeen)])","logSource":"IIS logs in LogScale","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","sourceDate":"2023-06-07","license":"CC0 1.0","origin":"vuln2shell","notes":"X-siLock-Comment only appears if custom header logging was on.","tested":"untested","timeRange":"From 2021-07-06"}],"thirdPartyQueries":[{"title":"MOVEit log indicator YARA rules","url":"https://github.com/Neo23x0/signature-base/blob/3ce6640c26046da8e6d8094af3eaaee3ee84e648/yara/vuln_moveit_0day_jun23.yar","author":"Florian Roth","date":"2023-06-13","language":"yara","license":"see source","origin":"vendor","note":"Scans IIS log files on disk for exploitation traces."},{"title":"CISA and FBI AA23-158A IOC files","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","author":"CISA and FBI","date":"2023-06-07","language":"stix","license":"public","origin":"vendor","note":"STIX and CSV IOCs published with the advisory."}],"artefacts":[{"kind":"file","value":"human2.aspx, _human2.aspx in the MOVEit wwwroot","detail":"LEMURLOOT webshell.","sourceUrl":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","sourceDate":"2023-06-07"},{"kind":"web-log","value":"POST bursts to guestaccess.aspx","detail":"SQL injection stage before webshell use.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","sourceDate":"2023-06-02"},{"kind":"web-log","value":"X-siLock-Comment, X-siLock-Step1/2/3 request headers","detail":"LEMURLOOT authentication and tasking.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","sourceDate":"2023-06-02"},{"kind":"account","value":"Health Check Service (RealName / LoginName)","detail":"Account created by the webshell.","sourceUrl":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","sourceDate":"2023-06-07"}],"iocs":[{"type":"filename","value":"human2.aspx","context":"LEMURLOOT webshell.","sourceUrl":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","sourceDate":"2023-06-07"},{"type":"ip","value":"45.129.137[.]232","context":"Source of MOVEit activity Kroll saw between 6 and 18 Jul 2021.","sourceUrl":"https://www.kroll.com/en/insights/publications/cyber/clop-ransomware-moveit-transfer-vulnerability-cve-2023-34362","sourceDate":"2023-06-08"}],"iocNote":"CISA and FBI published a full IOC set (IPs, hashes) with AA23-158A. Use that file rather than a copy here.","hitMeaning":[{"level":"attempt","detail":"guestaccess.aspx POSTs alone, with no webshell and no rogue account."},{"level":"likely-compromise","detail":"human2.aspx on disk or requested with a 200, or the Health Check Service account exists."},{"level":"confirmed-compromise","detail":"Webshell use with X-siLock headers plus large downloads. Assume data theft."}],"nextSteps":[{"title":"Follow Progress remediation","detail":"Take the instance off the internet, remove webshells and rogue accounts, patch, and reset credentials as Progress describes.","links":[{"label":"Progress guidance","href":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023"}]},{"title":"Treat it as a data breach","detail":"Work out which files and Azure settings were taken and follow your breach process.","links":[{"label":"AA23-158A","href":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a"}]}],"limits":["Header logging is off by default in IIS, so X-siLock headers are often missing.","Logs from 2021 and 2022 are rarely retained; Kroll's finding came from client IIS logs that happened to be kept."],"sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","date":"2023-06-02","publisher":"Mandiant"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","date":"2023-06-07","publisher":"CISA and FBI"},{"url":"https://www.kroll.com/en/insights/publications/cyber/clop-ransomware-moveit-transfer-vulnerability-cve-2023-34362","date":"2023-06-08","publisher":"Kroll"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"Progress MOVEit Transfer web application trains listed by NVD and CISA are in scope until the May 2023 first-fixed builds on the page (or later). The bug is unauthenticated SQL injection against the internet-facing web UI. SFTP and FTP/s are not the attack path Progress shut off.","checks":[{"id":"v2s-aia-moveit-transfer-version-1","kind":"version","title":"Compare installed MOVEit Transfer version to first-fixed builds","detail":"NVD / catalog first-fixed: 2021.0.6 (13.0.6), 2021.1.4 (13.1.4), 2022.0.4 (14.0.4), 2022.1.5 (14.1.5), 2023.0.1 (15.0.1). CISA AA23-158a also lists 2020.0.x and 2020.1.x as impacted. Read the version from the MOVEit Transfer About / product footer. Huntress documents HKLM\\SOFTWARE\\Standard Networks\\siLock for install paths (WebBaseDir, LogsBaseDir), not as a published version value.","command":"Get-ItemProperty 'HKLM:\\SOFTWARE\\Standard Networks\\siLock' | Select-Object WebBaseDir, LogsBaseDir; Write-Output 'Also read the product version from the MOVEit Transfer About / footer in the admin UI'","affectedMeans":"Any 2021.0.x before 2021.0.6, 2021.1.x before 2021.1.4, 2022.0.x before 2022.0.4, 2022.1.x before 2022.1.5, 2023.0.x before 2023.0.1, plus 2020.x trains CISA listed. H-ISAC 2023-06-01 quoted Progress fixed versions matching those 2021-2023 trains.","fixedMeans":"Installed version is at or above the first-fixed build for that train (2021.0.6 / 2021.1.4 / 2022.0.4 / 2022.1.5 / 2023.0.1 or later). Then complete Progress cleanup of webshells and accounts before re-enabling HTTP.","notes":"Later Progress patches exist after 31 May 2023. This brief uses the first-fixed table already on the catalog page and in NVD. Do not invent a 2020.x fixed build without the Progress article body.","sources":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34362","date":"2023-06-02","publisher":"NVD"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","date":"2023-06-07","publisher":"CISA / FBI"},{"url":"https://www.aha.org/system/files/media/file/2023/06/h-isac-tlp-white-volnerability-reports-progress-moveit-transfer-critical-vulnerability-actively-exploited.pdf","date":"2023-06-01","publisher":"H-ISAC quoting Progress"},{"url":"https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response","date":"2023-06-01","publisher":"Huntress"}]},{"id":"v2s-aia-moveit-transfer-config-2","kind":"config","title":"Locate the MOVEit wwwroot and confirm HTTP/HTTPS listeners","detail":"Huntress: HKLM\\SOFTWARE\\Standard Networks\\siLock WebBaseDir points at the web root (often C:\\MOVEitTransfer\\wwwroot, path customizable, other drives seen). Progress mitigation (quoted by H-ISAC and Huntress): deny HTTP and HTTPS to ports 80 and 443 until patched. SFTP and FTP/s continue.","command":"(Get-ItemProperty 'HKLM:\\SOFTWARE\\Standard Networks\\siLock').WebBaseDir; Get-NetTCPConnection -LocalPort 80,443 -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess","affectedMeans":"A MOVEit wwwroot exists and TCP 80 or 443 is listening and reachable from untrusted networks while the version is below the first-fixed build.","fixedMeans":"Version is first-fixed or later, or HTTP/HTTPS to 80/443 is denied at the firewall per Progress until the patch is applied.","sources":[{"url":"https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response","date":"2023-06-01","publisher":"Huntress"},{"url":"https://www.aha.org/system/files/media/file/2023/06/h-isac-tlp-white-volnerability-reports-progress-moveit-transfer-critical-vulnerability-actively-exploited.pdf","date":"2023-06-01","publisher":"H-ISAC quoting Progress"},{"url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023","date":"2023-05-31","publisher":"Progress Software"}]},{"id":"v2s-aia-moveit-transfer-exposure-3","kind":"exposure","title":"Internet-facing MOVEit Transfer in your ranges","detail":"Catalog Shodan query http.title:\"MOVEit\". Censys 2023-06-02 reported over 3,000 exposed hosts globally. Scope to your ranges.","command":"shodan search 'http.title:\"MOVEit\" net:<your-range>'","affectedMeans":"A MOVEit web title in your net or org whose version is not confirmed at or above the first-fixed build.","fixedMeans":"No public MOVEit HTTP/HTTPS in your ranges, or every hit is confirmed patched and cleaned.","sources":[{"url":"https://www.shodan.io/search?query=http.title%3A%22MOVEit%22","date":"2026-10-23","publisher":"Shodan (catalog snapshot)"},{"url":"https://censys.com/blog/moveit-transfer/","date":"2023-06-02","publisher":"Censys"}]}],"limits":["WebBaseDir is an install path, not a version. Confirm version from the product UI.","CISA lists 2020.x as impacted. A 2020 first-fixed build is not copied here because the Progress article body did not render.","human2.aspx absence does not prove the host was never exploited (Huntress: webshell is an option, not required for RCE)."],"sources":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34362","date":"2023-06-02","publisher":"NVD"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","date":"2023-06-07","publisher":"CISA / FBI"},{"url":"https://www.aha.org/system/files/media/file/2023/06/h-isac-tlp-white-volnerability-reports-progress-moveit-transfer-critical-vulnerability-actively-exploited.pdf","date":"2023-06-01","publisher":"H-ISAC quoting Progress"},{"url":"https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response","date":"2023-06-01","publisher":"Huntress"},{"url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023","date":"2023-05-31","publisher":"Progress Software"},{"url":"https://www.shodan.io/search?query=http.title%3A%22MOVEit%22","date":"2026-10-23","publisher":"Shodan (catalog snapshot)"},{"url":"https://censys.com/blog/moveit-transfer/","date":"2023-06-02","publisher":"Censys"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"TrustedSec 1 Jun 2023, quoting Progress: deny all HTTP (TCP/80) and HTTPS (TCP/443) traffic to the MOVEit environment until patched. SFTP/FTP still work. This does not remove a webshell already written.","items":[{"title":"Deny HTTP (TCP/80) and HTTPS (TCP/443) to MOVEit Transfer until patched","detail":"TrustedSec 1 Jun 2023: Progress mitigations are to deny all HTTP (TCP/80) and HTTPS (TCP/443) traffic to the MOVEit environment. This blocks web access; SFTP/FTP still work. Huntress 1 Jun 2023: Progress's suggested mitigation is firewall deny rules on ports 80 and 443, which takes the web application out of service.","limits":"Does not remove a webshell or Health Check Service account already written. Huntress: the observed human2.aspx is persistence, not required for RCE. Re-enable HTTP only after patch and IOC review.","verify":"From an untrusted network, TCP 80 and 443 to the MOVEit host should fail. From the host: Get-NetFirewallRule or the edge ACL should show deny 80/443.","source":{"url":"https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/","date":"2023-06-01","publisher":"TrustedSec"}}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"Keep 80/443 closed while you hunt LEMURLOOT (human2.aspx) and the Health Check Service admin account. Mandiant observed file theft within minutes, including Azure Blob settings.","containment":[{"title":"Keep HTTP/HTTPS denied while investigating and patching","detail":"TrustedSec 1 Jun 2023: Progress mitigations deny HTTP/HTTPS 80/443. Huntress 1 Jun 2023 repeats the firewall deny. Do not re-open the web UI until webshells and rogue accounts are removed and the first-fixed build is installed.","sources":[{"url":"https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/","date":"2023-06-01","publisher":"TrustedSec"},{"url":"https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response","date":"2023-06-01","publisher":"Huntress"}]},{"title":"Assume file theft and treat it as a breach","detail":"Mandiant: in some instances data theft occurred within minutes of webshell deployment. LEMURLOOT can steal Azure Blob account, key, and container from application settings. CISA/FBI: internet-facing MOVEit web apps were infected with LEMURLOOT then used to steal database data.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","date":"2023-06-02","publisher":"Mandiant"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","date":"2023-06-07","publisher":"CISA / FBI"}]},{"title":"Do not rebuild the web tier and leave the database","detail":"CISA: if a victim rebuilds the web server but leaves the database intact, the CL0P user accounts will still exist and can be used for persistent access.","sources":[{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","date":"2023-06-07","publisher":"CISA / FBI"}]}],"rotate":[{"item":"Azure Blob storage account key and any Azure credentials stored in MOVEit settings","reason":"Mandiant: LEMURLOOT retrieves AzureBlobStorageAccount, AzureBlobKey, and AzureBlobContainer when X-siLock-Step1 is -1. Huntress notes the webshell can leak Azure information.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","date":"2023-06-02","publisher":"Mandiant"}]},{"item":"MOVEit service and database credentials, plus any admin sessions","reason":"LEMURLOOT creates an administrator-privileged account (LoginName and RealName Health Check Service) and an active session. Huntress: code runs as moveitsvc, which is in local administrators. Rotate those secrets after cleanup.","sources":[{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","date":"2023-06-07","publisher":"CISA / FBI"},{"url":"https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response","date":"2023-06-01","publisher":"Huntress"}]},{"item":"Credentials of files stored in MOVEit that may have been downloaded","reason":"Mandiant and CISA describe large-volume file theft from the MOVEit database and local store. Rotate secrets that lived in stolen files.","generic":true}],"persistence":[{"kind":"webshell","value":"human2.aspx / _human2.aspx in the MOVEit wwwroot (masquerade of legitimate human.aspx)","detail":"Mandiant named LEMURLOOT and observed those filenames. CISA: initially observed as human2.aspx. Huntress: C:\\MOVEitTransfer\\wwwroot\\human2.aspx (no space; path customizable).","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","sourceDate":"2023-06-02"},{"kind":"account","value":"Health Check Service (LoginName and RealName)","detail":"CISA and Mandiant: webshell creates an admin account with those names and can delete it (X-siLock-Step1 = -2). CISA SQL: SELECT * FROM [].[dbo].[users] WHERE Permission=30 AND Status='active' and Deleted='0'","sourceUrl":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","sourceDate":"2023-06-07"},{"kind":"path","value":"Temporary ASP.NET compiled DLL under C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Temporary ASP.NET Files\\root\\","detail":"Huntress: first render of human2.aspx compiles via csc.exe from w3wp.exe (moveitdmz pool) to App_Web_*.dll in that tree. A second App_Web_*.dll besides the long-lived legitimate one is a compromise signal.","sourceUrl":"https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response","sourceDate":"2023-06-01"},{"kind":"other","value":"Unexpected files in c:\\MOVEit Transfer\\wwwroot\\ (Progress wording) or C:\\MOVEitTransfer\\wwwroot\\","detail":"H-ISAC quoting Progress step 2: check for unexpected files in c:\\MOVEit Transfer\\wwwroot\\ on all instances including backups, and unexpected or large file downloads, over at least the past 30 days (Progress 31 May 2023 guidance).","sourceUrl":"https://www.aha.org/system/files/media/file/2023/06/h-isac-tlp-white-volnerability-reports-progress-moveit-transfer-critical-vulnerability-actively-exploited.pdf","sourceDate":"2023-06-01"}],"evidence":[{"title":"IIS logs for guestaccess.aspx POSTs and human2.aspx","detail":"Mandiant: several POST requests to legitimate guestaccess.aspx before LEMURLOOT use. Huntress published a 2023-05-30 IIS excerpt with POST /guestaccess.aspx, /api/v1/token, moveitisapi.dll, then GET /human2.aspx. Preserve IIS from at least 2023-05-27 (Mandiant earliest exploitation); Kroll reported older testing in 2021-2022 if logs exist.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","date":"2023-06-02","publisher":"Mandiant"},{"url":"https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response","date":"2023-06-01","publisher":"Huntress"}]},{"title":"Custom request headers if logged","detail":"Mandiant/CISA: X-siLock-Comment (36-character GUID password), X-siLock-Step1 / Step2 / Step3. IIS does not log these by default.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","date":"2023-06-02","publisher":"Mandiant"}]},{"title":"MOVEit database users and sessions","detail":"CISA SQL audit for Permission=30 active users. Look for Health Check Service. Export before rebuild.","sources":[{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","date":"2023-06-07","publisher":"CISA / FBI"}]},{"title":"Standard IR artifacts before rebuild","detail":"Disk image of the MOVEit host, wwwroot, Temporary ASP.NET Files, MOVEit logs (Huntress: LogsBaseDir), egress logs for large downloads.","generic":true}],"sources":[{"url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023","date":"2023-05-31","publisher":"Progress Software"},{"url":"https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response","date":"2023-06-01","publisher":"Huntress"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","date":"2023-06-02","publisher":"Mandiant"},{"url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","date":"2023-06-07","publisher":"CISA / FBI"},{"url":"https://www.aha.org/system/files/media/file/2023/06/h-isac-tlp-white-volnerability-reports-progress-moveit-transfer-critical-vulnerability-actively-exploited.pdf","date":"2023-06-01"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"Akamai","title":"MOVEit SQLi zero-day exploited by Clop ransomware group","url":"https://www.akamai.com/blog/security-research/moveit-sqli-zero-day-exploit-clop-ransomware","date":"2023-06-08","cve":"CVE-2023-34362"},{"vendor":"Cato Networks","title":"MOVEit vulnerability (CVE-2023-34362): how Cato protects against it","url":"https://www.catonetworks.com/blog/cato-protects-against-moveit-vulnerability-cve-2023-34362/","date":"2026-10-23","cve":"CVE-2023-34362"},{"vendor":"Cato Networks","title":"Rapid CVE Mitigation by Cato Security Research","url":"https://www.catonetworks.com/rapid-cve-mitigation/","date":"2026-10-23","cve":"CVE-2023-34362","dateKind":"checked"},{"vendor":"Check Point","title":"CPAI-2023-0386 Progress MOVEit Transfer SQL Injection","url":"https://advisories.checkpoint.com/defense/advisories/public/2023/cpai-2023-0386.html/","date":"2023-06-04","cve":"CVE-2023-34362"},{"vendor":"Cisco Talos","title":"Snort Talos Rules 2023-06-02","url":"https://www.snort.org/advisories/talos-rules-2023-06-02","date":"2023-06-02","cve":"CVE-2023-34362"},{"vendor":"Citrix","title":"NetScaler signature update version 106","url":"https://docs.netscaler.com/en-us/citrix-adc/13-1/signature-alerts/signature-update-version-106.html","date":"2026-10-23","cve":"CVE-2023-34362","dateKind":"checked"},{"vendor":"F5","title":"F5 Distributed Cloud attack signatures reference","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2023-06-15","cve":"CVE-2023-34362"},{"vendor":"Fastly","title":"Added virtual patch for CVE-2023-34362","url":"https://www.fastly.com/documentation/reference/changes/2023/06/added-virtual-patch-for-cve-2023-34362/","date":"2023-06-12","cve":"CVE-2023-34362"},{"vendor":"Fortinet","title":"FortiGuard search: CVE-2023-34362","url":"https://www.fortiguard.com/search?q=CVE-2023-34362&engine=1","date":"2023-06-15","cve":"CVE-2023-34362"},{"vendor":"Fortinet","title":"FortiGuard Outbreak Alert: Progress MOVEit Transfer SQL Injection","url":"https://www.fortiguard.com/outbreak-alert/progress-moveit-transfer-sql-injection","date":"2026-10-23","cve":"CVE-2023-34362","dateKind":"checked"},{"vendor":"Imperva","title":"CVE-2023-34362 MOVEit Transfer: an attack chain that retrieves sensitive information","url":"https://www.imperva.com/blog/cve-2023-34362-moveit-transfer/","date":"2023-06-06","cve":"CVE-2023-34362"},{"vendor":"Juniper","title":"HTTP:SQL:INJ:PROGRESS-MOVEIT-2","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:SQL:INJ:PROGRESS-MOVEIT-2.html","date":"2023-08-10","cve":"CVE-2023-34362"},{"vendor":"Netskope","title":"Netskope Threat Coverage: MOVEit Transfer Zero-Day","url":"https://threatlabs.netskope.com/blog/2023/06/netskope-threat-coverage-moveit-transfer-zero-day/","date":"2023-06-02","cve":"CVE-2023-34362"},{"vendor":"Netskope","title":"SERVER-WEBAPP MOVEit Transfer moveitisapi.dll SQL injection attempt (library entry, undated)","url":"https://threatlabs.netskope.com/library/ips/server-webapp-moveit-transfer-moveitisapi-dll-sql-injection-attempt/","date":"2026-10-23","cve":"CVE-2023-34362","dateKind":"checked"},{"vendor":"Palo Alto Networks","title":"Threat Brief: MOVEit Transfer SQL injection vulnerabilities (CVE-2023-34362)","url":"https://unit42.paloaltonetworks.com/threat-brief-moveit-cve-2023-34362/","date":"2023-10-04","cve":"CVE-2023-34362"},{"vendor":"Sophos","title":"Sophos IPS signature update 18.24.96","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.24.96.html","date":"2026-06-03","cve":"CVE-2023-34362"},{"vendor":"Trend Micro","title":"SECURITY ALERT: Multiple Vulnerabilities in MOVEit Transfer","url":"https://success.trendmicro.com/en-US/solution/KA-0014759","date":"2026-10-23","cve":"CVE-2023-34362","dateKind":"checked"},{"vendor":"Zscaler","title":"Coverage Advisory for CVE-2023-34362 MOVEit Transfer vulnerabilities","url":"https://www.zscaler.com/blogs/security-research/coverage-advisory-cve-2023-34362-moveit-transfer-vulnerabilities","date":"2023-06-09","cve":"CVE-2023-34362"}],"coverage":[{"title":"MOVEit Transfer Critical Vulnerability 31 May 2023","publisher":"Progress Software","url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023","date":"2023-05-31","type":"vendor"},{"title":"Zero-Day Vulnerability in MOVEit Transfer Exploited for Data Theft","publisher":"Mandiant","url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","date":"2023-06-02","type":"research"},{"title":"#StopRansomware: CL0P Ransomware Gang Exploits CVE-2023-34362","publisher":"CISA / FBI","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","date":"2023-06-07","type":"government"}],"posts":[],"research":[{"title":"Progress MOVEit Transfer advisory","url":"https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023","authors":"Progress Software","date":"2023-05-31"},{"title":"Mandiant MOVEit analysis","url":"https://cloud.google.com/blog/topics/threat-intelligence/zero-day-moveit-data-theft","authors":"Mandiant","date":"2023-06-02"},{"title":"CISA/FBI AA23-158a","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a","authors":"CISA / FBI","date":"2023-06-07"},{"title":"NVD CVE-2023-34362","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34362","authors":"NVD","date":"2023-06-02"}],"impact":{"kind":"single-product","product":"Progress MOVEit Transfer","versions":[{"version":"MOVEit Transfer 2023.0.x","status":"affected","versions":"2023.0.1 (15.0.1)","vendorStatement":{"date":"2023-06-02","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34362","quote":"In Progress MOVEit Transfer before ... and 2023.0.1 (15.0.1), a SQL injection vulnerability has been found in the MOVEit Transfer web application."}},{"version":"MOVEit Transfer 2022.1.x","status":"affected","versions":"2022.1.5 (14.1.5)","vendorStatement":{"date":"2023-06-02","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34362","quote":"Before 2022.1.5 (14.1.5) ... a SQL injection vulnerability has been found in the MOVEit Transfer web application."}},{"version":"MOVEit Transfer 2022.0.x","status":"affected","versions":"2022.0.4 (14.0.4)","vendorStatement":{"date":"2023-06-02","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34362","quote":"Before 2022.0.4 (14.0.4) ... a SQL injection vulnerability has been found in the MOVEit Transfer web application."}},{"version":"MOVEit Transfer 2021.1.x","status":"affected","versions":"2021.1.4 (13.1.4)","vendorStatement":{"date":"2023-06-02","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34362","quote":"Before 2021.1.4 (13.1.4) ... a SQL injection vulnerability has been found in the MOVEit Transfer web application."}},{"version":"MOVEit Transfer 2021.0.x","status":"affected","versions":"2021.0.6 (13.0.6)","vendorStatement":{"date":"2023-06-02","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-34362","quote":"Before 2021.0.6 (13.0.6) ... a SQL injection vulnerability has been found in the MOVEit Transfer web application."}}]},"pocs":[{"title":"horizon3ai/CVE-2023-34362","url":"https://github.com/horizon3ai/CVE-2023-34362","source":"Horizon3","validationStatus":"validated","validationDate":"2023-06-09","notes":"Public repository created 9 Jun 2023. Description: MOVEit CVE-2023-34362."}],"_feed":{"page":"https://vuln2shell.com/vulns/moveit-transfer","json":"https://vuln2shell.com/vulns/moveit-transfer.json","iocsCsv":"https://vuln2shell.com/vulns/moveit-transfer/iocs.csv","stix":"https://vuln2shell.com/vulns/moveit-transfer/stix.json"}}