CVE-2021-37614
📋 TL;DR
This SQL injection vulnerability in Progress MOVEit Transfer allows authenticated remote attackers to execute arbitrary SQL queries against the database. Attackers can read, modify, or delete database contents, potentially compromising sensitive file transfer data. Organizations using affected MOVEit Transfer versions before the patched releases are vulnerable.
💻 Affected Systems
- Progress MOVEit Transfer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data exfiltration, data destruction, or full system takeover via privilege escalation.
Likely Case
Unauthorized access to sensitive file transfer metadata, user credentials, and potentially file contents stored in the database.
If Mitigated
Limited impact with proper network segmentation, database permissions, and monitoring in place.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited. Requires authenticated access but exploitation is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2019.0.7 (11.0.7), 2019.1.6 (11.1.6), 2019.2.3 (11.2.3), 2020.0.6 (12.0.6), 2020.1.5 (12.1.5), or 2021.0.3 (13.0.3) depending on your version
Vendor Advisory: https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-August-2021
Restart Required: Yes
Instructions:
1. Download the appropriate patch from Progress Software support portal. 2. Backup your MOVEit Transfer installation and database. 3. Apply the patch following vendor instructions. 4. Restart MOVEit Transfer services. 5. Verify successful update.
🔧 Temporary Workarounds
Network Segmentation
allRestrict access to MOVEit Transfer to only trusted IP addresses and networks.
Database Permission Reduction
allLimit database user permissions to only necessary operations (SELECT, INSERT, UPDATE on specific tables).
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the MOVEit Transfer interface
- Enhance monitoring of database queries and implement SQL injection detection at the application or database layer
🔍 How to Verify
Check if Vulnerable:
Check MOVEit Transfer version in web interface (Admin > System > About) or installation directory.Check Version:
Check web interface at /admin/about.aspx or examine MOVEit installation directory version files.Verify Fix Applied:
Verify version number matches patched versions listed in affected_systems.versions.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL error messages in application logs
- Multiple failed authentication attempts followed by successful login
- Unusual database query patterns from MOVEit application user
Network Indicators:
- SQL injection payloads in HTTP POST requests to MOVEit endpoints
- Unusual outbound database connections from MOVEit server
SIEM Query:
source="moveit_logs" AND ("sql error" OR "syntax error" OR "unclosed quotation")🔗 References
- https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-August-2021
- https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htm
- https://docs.ipswitch.com/MOVEit/Transfer2020/ReleaseNotes/en/index.htm#50951.htm
- https://docs.ipswitch.com/MOVEit/Transfer2021/ReleaseNotes/en/index.htm#link8
- https://community.progress.com/s/article/MOVEit-Transfer-Vulnerability-August-2021
- https://docs.ipswitch.com/MOVEit/Transfer2019/ReleaseNotes/en/index.htm#48648.htm
- https://docs.ipswitch.com/MOVEit/Transfer2020/ReleaseNotes/en/index.htm#50951.htm
- https://docs.ipswitch.com/MOVEit/Transfer2021/ReleaseNotes/en/index.htm#link8
