MOVEit Transfer CVE-2023-34362 & CVE-2023-35036: SQL injection to .NET deserialization RCE
The MOVEit Transfer chain behind one of 2023's largest breach waves: an unauthenticated stacked SQL injection, privilege escalation, an IP-whitelist bypass, and unsafe .NET deserialization for code execution. Dau Hoang Tai's full end-to-end analysis (in Vietnamese) is on HackMD; this is the short version with the link.
Originally published by Dau Hoang Tai on hackmd.io/@taidh. Read the original.MOVEit Transfer is a managed file-transfer server. In mid-2023 it became the epicenter of one of the year's largest breach waves, and CVE-2023-34362 (CVSS 9.8) is why. It is not a single bug but a chain: an unauthenticated stacked SQL injection in the web interface, privilege escalation by inserting an attacker-controlled admin account, an IP-whitelist bypass to reach an internal-only endpoint, and finally unsafe .NET deserialization that turns database control into remote code execution. A second SQL injection in the same family shipped as CVE-2023-35036 (CVSS 9.1).
Our co-founder Dau Hoang Tai (taidh) published a full end-to-end reverse-engineering analysis of both CVEs — the injectable UserGetUsersWithEmailAddress path, the hostpermits whitelist write, the ISAPI header bypass, the two-stage upload that triggers DeserializeFileUploadStream, and the FolderIDToPath / CleanForSQL backslash-escape gap. It is a long, code-level read and it lives on his own HackMD (in Vietnamese).
Read the complete, code-level analysis on taidh's blog: Analysis CVE-2023-34362 & CVE-2023-35036 (MOVEit Transfer).
Mitigation: patch MOVEit Transfer for both CVEs and follow Progress's advisories; if you ran a vulnerable version while exposed, assume compromise and hunt for unexpected admin accounts, rows added to hostpermits, and files dropped by the deserialization step.
References & further reading
Dau Hoang Tai
Co-Founder, Starfish Security