SQL Injection

MOVEit Transfer — Zero-Day SQL Injection, Mass Data Theft

What Happened

On May 31, 2023, Progress Software disclosed a critical SQL injection vulnerability in MOVEit Transfer — a managed file transfer (MFT) software used by banks, healthcare, and government agencies. The Cl0p ransomware group had been exploiting it since May 27, days before the patch was available. They injected SQL via the X-siLock-Step1 and X-siLock-Step2 headers to dump the entire database, then used a second vulnerability (CVE-2023-35036) to escalate to file system access.

Root Cause

SQL injection in a SOAP-like API endpoint. The /guestaccess.aspx endpoint accepted specially crafted headers that were directly interpolated into SQL queries without parameterization. The attacker could extract database contents including file metadata, user credentials, and Azure blob storage keys. A second flaw let them write webshells to disk via crafted filenames.

Who Was Affected

  • 2,700+ organizations confirmed compromised
  • 95+ million individuals' data stolen
  • Shell, British Airways, BBC, PwC, Zellis payroll (UK)
  • U.S. Department of Energy, Department of Health
  • Multiple state government agencies
  • Total extortion payments: estimated $75–100 million

How It Was Detected

Huntress and Mandiant discovered the exploitation while investigating anomalous MOVEit server behavior. The attackers were inside customer environments stealing data while the CVE was still being analyzed. Forensic analysis revealed the SQL injection vector in IIS logs showing unusual HTTP requests to /guestaccess.aspx.

How It Was Fixed

Progress released patches within 48 hours of the initial disclosure:

  • May 31, 2023: Initial patch for CVE-2023-34362
  • June 9, 2023: Patch for CVE-2023-35036 (second SQLi)
  • June 15, 2023: Patch for CVE-2023-35708 (third vulnerability)
  • Three CVEs, three patches, one product — all discovered within two weeks

    • Lessons for Your SaaS

    • Every file transfer endpoint is a target. If your SaaS handles file uploads, downloads, or transfers, those endpoints deserve the most aggressive security scrutiny — not the least.
    • Vendor risk is your risk. If you used MOVEit as a vendor and didn't know it was in your supply chain, you were still liable for the breach. Map your third-party dependencies.
    • Weeks matter. Cl0p exploited the zero-day for 4 days before disclosure. If your vendor isn't monitoring for anomalous behavior in their own products, you're the detection layer.
    • SQL injection is not dead. In 2023, a billion-dollar company had SQL injection in a product used by the world's largest organizations. Parameterize everything.
    Request a Security Assessment