MOVEit Transfer Bug

The Cybersecurity and Infrastructure Security Agency, or CISA for short, recently added a security bug from the popular Progress MOVEit Transfer managed file transfer (MFT) solution to their list of known exploited vulnerabilities. 

The flaw in question, known as CVE-2023-34362, is a SQL injection vulnerability.What you need to know is that this vulnerability allows unauthenticated attackers to remotely access MOVEit Transfer's database and execute any code they desire.!

In a binding operational directive (BOD) issued back in November 2022, federal agencies were ordered to patch this security vulnerability once it made its way onto CISA's Known Exploited Vulnerabilities catalog. So, federal agencies are already on high alert. Even if you're not a federal agency, it is highly recommended that private companies also prioritize securing their systems against this actively exploited flaw in MOVEit Transfer. Don't let your guard down just because you're not part of the government.

The good folks at Progress, the creators of MOVEit Transfer, are urging all their customers to patch their instances immediately. It's the first line of defense against exploitation attempts and potential breaches. So, take their advice seriously, folks.

If you can't apply the security patches right away, there's still something you can do. You can temporarily disable all HTTP and HTTPS traffic to your MOVEit Transfer environments. This will help minimize the attack surface and reduce the risk of being targeted.

Remember, proactive measures are key to keeping your systems secure. Don't let these vulnerabilities sneak up on you. Stay vigilant, patch your systems, and keep those security defenses strong.