Technical intelligence and weaponization dossier for CVE-2023-34362. Documented exploitation across 1 active malware families totaling 140 analyzed telemetry samples.
| Vulnerability ID | CVE-2023-34362 |
|---|---|
| Common Name / Bulletin | Progress Software MOVEit Transfer SQL Injection Remote Code Execution Vulnerability (Cl0p Ransomware) (Progress Software MOVEit Transfer Security Bulletin) |
| CWE Classification | CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
| Affected Software & Versions | MOVEit Transfer versions before 2021.0.6, 2021.1.4, 2022.0.4, 2022.1.5, 2023.0.1 |
| Technical Root Cause | Pre-authentication SQL injection vulnerability in the MOVEit Transfer web application allowing unauthenticated remote attackers to submit crafted payloads, gain access to the underlying database, drop webshells (human2.aspx), and exfiltrate massive corporate file archives. |
| Associated ATT&CK Techniques |
Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:
| Malware Family | Category | Catalog Samples | Operational Profile |
|---|---|---|---|
| clop | Ransomware | 140 | Clop (stylized as Cl0p) is a notorious Russian-speaking ransomware and extortion syndicate operated by threat group FIN11 (also tracked as TA505 and Lace Tempes... |
Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2023-34362 in enterprise networks:
IIS web access logs indicating abnormal HTTP POST requests to /moveitisapi/moveitisapi.dll or creation of unauthorized human2.aspx files in the MOVEit Transfer wwwroot directory.SOC containment checklist and attack surface reduction measures to neutralize exploitation:
For end-to-end incident response procedures, consult our dedicated playbook: Ransomware Containment & Incident Response →