MOVEit Transfer, a widely deployed MFT product, was the subject of a mass-exploitation campaign driven by an unauthenticated SQL injection in its web application. The injection was reachable without credentials on the internet-facing portal and chained from database access to writing a web component and accessing stored files, so attackers could enumerate the appliance's tenants and exfiltrate their files and metadata in bulk. The combination of internet exposure, no authentication, and the sensitive multi-tenant data made it devastating.
# fingerprint MOVEit
curl -skI https://<target>/ # MOVEit-specific headers/paths
curl -sk https://<target>/human.aspx -i | grep -i moveit
# the exploitation is an unauthenticated SQLi against a vulnerable web endpoint,
# used to reach the database, then write/stage a component and pull stored files.
# match the exact MOVEit build to the advisory for the vulnerable endpoint and payload.
Exploitation notes#
- The entry is unauthenticated SQL injection on the web portal; reaching the portal is the only precondition, which is why internet-facing MOVEit instances were compromised at scale.
- The chain goes from SQLi to file/component write to accessing the stored transfer files and metadata, so the payoff is bulk data theft across all tenants, plus code execution on the appliance.
- Fingerprint the MOVEit build precisely and match to the advisory; the vulnerable endpoint and the exact injection are version-specific. The injection and escalation classes are on Injection to RCE.
- Prioritise the stored files, metadata, and the appliance's keys/configuration once access is gained; that is the campaign's actual objective.