Detailed analysis of the Zero- Day vulnerability in MOVEit transfer

Key Takeaways

• A common feature among all exploited devices is a webshell named ‘human2.aspx’ located in the ‘C:\MOVEitTransfer\wwwroot’ public HTML folder. Multiple IP addresses have been associated with the attacks, and the attacks reportedly started on May 27th.
• The exploitation method strongly resembles the mass exploitations of GoAnywhere MFT and Accellion FTA servers in January 2023 and December 2020 respectively. These previous incidents were linked to the Clop ransomware gang, who exploited managed file transfer platforms for data theft and extortion.
• The threat actor Lace Tempest has been officially linked to the exploitation of a critical flaw in Progress Software’s MOVEit Transfer application. Their apparent collaboration with the cl0p ransomware group, as evidenced by ransom notes found on compromised hosts, reinforces the urgent need for users to promptly apply security patches. The PoC exploit code for MOVEit Transfer was released by Horizon3 company.
• On June 15th, a third vulnerability (CVE-2023-35708) in Progress Software’s MOVEit Transfer was found. This vulnerability could allow users to gain elevated rights and potentially unapproved access to the environment. The vulnerability’s specific characteristics that enable worming are unknown. In addition, no evidence of an exploit of the vulnerability has been found by researchers.

Recommendations

• Immediate measures include blocking external traffic to ports 80 and 443, inspecting the MOVEit Transfer folder for unexpected files, and conducting thorough forensic examinations for any signs of compromise. Organizations are urged to prepare for potential extortion and public disclosure of stolen A patch is expected to be released by Progress Software Corporation to address the vulnerability and should be applied promptly upon its release.
• Search for the subsequent potential indications of unauthorized intrusion over the past 30 days e., at least emergence of unexpected files in the C:\MOVEitTransfer\wwwroot directory across all your MOVEit Transfer instances (back-ups included), unanticipated and/or extensive file downloads.
• The patch is already published by a vendor.

This vulnerability needs emergency patching.

Introduction

In layman’s terms, we’ve been investigating a serious cybersecurity issue with a popular software called MOVEit Transfer. This software has a security flaw, known as a ‘zero-day vulnerability’, which is currently being exploited by hackers to steal data from many organizations. The exact identity of these threat actors is unknown as no extortion attempts have been made so far. The nature of these cyberattacks closely resembles previous large-scale attacks in 2020 and 2023 on similar types of software. These past incidents were attributed to a criminal group known as the Clop ransomware gang.

A new vulnerability affecting Progress Software’s MOVEit Transfer application was disclosed on June 15th as the Cl0p cybercrime outfit used extortion against the affected businesses.

Technical Details

Around 2,500 exposed MOVEit servers, mainly in the US, are at risk. A common feature found across all exploited devices is a webshell named ‘human2.asp’, located in the ‘C:\MOVEit Transfer\wwwroot’ public HTML folder. This webshell first checks if the inbound request contains a specific password-like value in the ‘X-siLock-Comment’ header, returning a 404 “Not Found” error if the header isn’t correctly populated.

Once accessed with the correct password, the webshell executes commands based on the values of the ‘X-siLock-Step1’, ‘X-siLock-Step1’, and ‘X-siLock-Step3’ request headers. This enables the threat actor to interact with MOVEit’s MySQL server and perform various actions, including retrieving file details, manipulating user entries, acquiring Azure Blob Storage account configuration, and downloading files.

Randomly named ‘App_Web\_<random>.dll’ files, such as ‘App_Web_feevjhtu.dll’, have also been reported in the aftermath of breaches, in addition to the typical presence of one such file. The vulnerability can be found as CVE-2023-34362.

A new vulnerability, designated CVE-2023-35708, also relates to a SQL injection flaw that could result in elevated privileges and potential unauthorised access to the environment. A SQL injection vulnerability has been found in the MOVEit Transfer online application, which might let an unauthenticated attacker access the MOVEit Transfer database without authorization.

An attacker could modify and reveal the content of the MOVEit database by sending a specially crafted payload to a MOVEit Transfer application endpoint. However, researchers have not come across any proof that the vulnerability has been exploited.

Affected Products

• MOVEit Transfer 2023.0.0
• MOVEit Transfer 1.x
• MOVEit Transfer 2022.0.x
• MOVEit Transfer 1.x
• MOVEit Transfer 2021.0.x
• MOVEit Transfer 2023.0.1, 2023.0.2 (15.0.1, 15.0.2)
• MOVEit Transfer 2022.1.5, 2022.1.6 (14.1.5, 14.1.6)
• MOVEit Transfer 2022.0.4, 2022.0.5 (14.0.4, 14.0.5)
• MOVEit Transfer 2021.1.4, 2021.1.5 (13.1.4, 13.1.5)
• MOVEit Transfer 2021.0.6, 2021.0.7 (13.0.6, 13.0.7)
• MOVEit Transfer 2020.1.6 (12.1.6) or later
• MOVEit Transfer 2020.0.x (12.0) or older

Available Vendor Patches

Progress Software Corporation already published the patch. The files are accessible at below link:

Available Mitigations

Step 1: Suspend all HTTP and HTTPS activity directed to your MOVEit Transfer environment till patch is released.

More precisely:

• Adjust firewall rules to refuse HTTP and HTTPS traffic to MOVEit Transfer on ports 80 and
• Keep in mind, until HTTP and HTTPS traffic is reinstated: Users will be incapable of signing in to the MOVEit Transfer web UI MOVEit Automation tasks that use the native MOVEit Transfer host will become inactive REST, Java and .NET APIs will be non-operational The MOVEit Transfer plugin for Outlook will cease to work However, SFTP and FTP/s protocols will continue functioning normally Administrators will retain access to MOVEit Transfer by utilizing a remote desktop connection to the Windows device and then navigating to https://localhost/
• Users will be incapable of signing in to the MOVEit Transfer web UI
• MOVEit Automation tasks that use the native MOVEit Transfer host will become inactive
• REST, Java and .NET APIs will be non-operational
• The MOVEit Transfer plugin for Outlook will cease to work
• However, SFTP and FTP/s protocols will continue functioning normally Administrators will retain access to MOVEit Transfer by utilizing a remote desktop connection to the Windows device and then navigating to

Step 2: Inspect, Remove and Reset

2.1 Delete Unauthorized Files and USer Profiles

• Search for and remove any instances of the ‘human2.aspx’ and ‘cmdline’ script files;
• Check the ‘C:\MOVEitTransfer\wwwroot’ directory on the MOVEit Transfer server for any newly created files;
• Search for new files created in the ‘C:\Windows\TEMP\[random]’ directory with a ‘.cmdline’ file extension on the MOVEit Transfer server;
• Remove any unauthorized user profiles;
• Investigate logs for unanticipated file downloads from unrecognized IPs or a large quantity of files downloaded.

2.2 Reset Passwords

• Reset the service account passwords for affected systems as well as the MOVEit Service Account.

Use the IoC’s below to check for potential signs of compromise in the environment.

Step 3: Apply the Patch

This vulnerability needs emergency patching.

Attribution

The critical flaw in Progress Software’s MOVEit Transfer application is officially attributed to Lace Tempest, a threat actor tracked by Microsoft. Following exploitation, the threat actor typically deploys a web shell capable of data exfiltration.

Lace Tempest, alternatively known as Storm-0950, has affiliations with other notable groups, such as FIN11, TA505, and Evil Corp, and operates the Cl0p extortion site. The group’s past actions demonstrate a consistent pattern of exploiting zero-day vulnerabilities, including a recent severe bug in PaperCut servers, to steal data and extort victims.

Activity related to this threat actor is also tracked by Google-owned Mandiant under the label UNC4857, with the web shell identified as LEMURLOOT, and noted broad tactical connections with FIN11.

Public sources indicate collaboration between the threat actor, Lace Tempest, and the cl0p ransomware group. Evidence for this collaboration is based on ransom notes found on compromised hosts, which unambiguously link to the cl0p group.

Indicators of compromise

The standard path to detect this software is C:\MOVEitTransfer\webroot and the presence of the moveitisapi.dll library.

File path:

C:\MOVEitTransfer\wwwroot\human2.aspx

(?i)\MOVEit Transfer\wwwroot\\[^\\]{1,40}.(zip|rar|7z|exe|ps1|bat);70 (regex)

Folder path:

C:\Windows\TEMP\[random][random].cmdline

(Script that is executed to create the human2.aspx file. The folder path and filename are randomized.)

POST requests:

POST /moveitisapi/moveitisapi.dll

POST /guestaccess.aspx

POST /api/v1/folders/[random]/files

User account creation:

Health Check Service

(“Webshell creates a MOVEit Transfer user account session with the display name ‘Health Check Service’.”)

IP Addresses:

209.97.137[.]335.252.191[.]0/24148.113.152[.]14489.39.105[.]1085.252.190[.]1155.252.190[.]208209.97.137[.]335.252.189[.]0/245.252.190[.]0/24198.27.75[.]110209.222.103[.]17084.234.96[.]104

IP Addresses related with high confidence to Mass Scanners:

146.190.166[.]168138.68.153[.]47138.197.152[.]201

Side note:

The following addresses have been identified as instances of the mass scanner zGrab, which has a high probability of being treated as a False Positive. During various DFIR (Digital Forensics and Incident Response) actions, it may have been incorrectly assigned as an IoC directly related to the campaign, as its full-scale internet scanning makes it highly active in logs.

SHA256 Hashes (related to ‘human2.aspx’ filename on VirusTotal):

5b566de1aa4b2f79f579cdac6283b33e98fdc8c1cfa6211a787f8156848d67ff 0ea05169d111415903a1098110c34cdbbd390c23016cd4e179dd9ef507104495348e435196dd795e1ec31169bd111c7ec964e5a6ab525a562b17f10de0ab031d387cee566aedbafa8c114ed1c6b98d8b9b65e9f178cf2f6ae2f5ac441082747a3ab73ea9aebf271e5f3ed701286701d0be688bf7ad4fb276cb4fbe35c8af8409c56bcb513248885673645ff1df44d3661a75cfacdce485535da898aa9ba320d4fe5f8388ccea7c548d587d1e2843921c038a9f4ddad3cb03f3aa8a45c29c6a2f702421bcee1785d93271d311f0203da34cc936317e299575b06503945a6ea1e09d1723777de67bc7e11678db800d2a32de3bcd6c40a629cd165e3f7bbace8ead 9e89d9f045664996067a05610ea2b0ad4f7f502f73d84321fb07861348fdc24ad49cf23d83b2743c573ba383bf6f3c28da41ac5f745cde41ef8cd1344528c195 b1c299a9fe6076f370178de7b808f36135df16c4e438ef6453a39565ff2ec272 6015fed13c5510bbb89b0a5302c8b95a5b811982ff6de9930725c4630ec4011d 48367d94ccb4411f15d7ef9c455c92125f3ad812f2363c4d2e949ce1b615429a 2413b5d0750c23b07999ec33a5b4930be224b661aaf290a0118db803f31acbc5 e8012a15b6f6b404a33f293205b602ece486d01337b8b3ec331cd99ccadb562e

SHA256 Hashes (‘human2.aspx’ webshell used during exploitation as per vendor):

0b3220b11698b1436d1d866ac07cc90018e59884e91a8cb71ef8924309f1e0e9110e301d3b5019177728010202c8096824829c0b11bb0dc0bff55547ead182861826268249e1ea58275328102a5a8d158d36b4fd312009e4a2526f0bfbc30de22ccf7e42afd3f6bf845865c74b2e01e2046e541bb633d037b05bd1cdb296fa5958ccfb603cdc4d305fddd52b84ad3f58ff554f1af4d7ef164007cb843897616698a30c7251cf622bd4abce92ab527c3f233b817a57519c2dd2bf8e3d3ccb7db8a8f6c1ccba662a908ef7b0cb3cc59c2d1c9e2cbbe1866937da81c4c616e68986b5ef11d04604c9145e4fe1bedaeb52f2c2345703d52115a5bf11ea56d7fb6b03cec425b3383890b63f5022054c396f6d510fae436041add935cd6ce42033f621ed0c3e75b7ac2587a5892ca951707b4e0dd9c8b18aaf8590c24720d73aa6b90c

Sigma rule for File Creation detection: https://github.com/SigmaHQ/sigma/pull/4281/files#diff-57f376f5bc911cab912a22bf4e18faf321a8608d9ce72da7e121a8ed48238d21 (opens in a new tab)

Proof of Concept

Security researchers from Horizon3 released PoC for exploitation of MOVEit Transfer (CVE-2023-34362) – https://github.com/horizon3ai/CVE-2023-34362 (opens in a new tab). The company (Horizone3) summarizes its publication as follows: “This POC abuses an SQL injection to obtain a sysadmin API access token and then use that access to abuse a deserialization call to obtain remote code execution. This POC needs to reach out to an Identity Provider endpoint which hosts proper RS256 certificates used to forge arbitrary user tokens – by default this POC uses our IDP endpoint hosted in AWS. By default, the exploit will write a file to C:\Windows\Temp\message.txt. Alternative payloads can be generated by using the ysoserial.net project.”

It is important to note that publicly available PoC can motivate other threat actors to launch their own campaigns and hence increase the number of attacks.

References

• https://www.reddit.com/r/msp/comments/13xjs1y/tracking_emerging_moveit_transfer_critical/

List of changes

Glossary of terms