MOVEit Transfer Zero-Day Enabled Mass Data Theft Through SQL Injection and RCE

A critical pre-authentication flaw in Progress MOVEit Transfer, CVE-2023-34362, was actively exploited to compromise internet-facing managed file-transfer servers and steal customer data. The vulnerability allowed SQL injection over HTTP/HTTPS, enabling attackers to manipulate the database, establish privileged sessions, deploy the human2.aspx ASPX webshell, and access or exfiltrate stored files. Microsoft attributed the campaign to Lace Tempest, associated with the Cl0p extortion ecosystem; Cl0p subsequently demanded that victims make contact or face publication of stolen data.

Technical analysis found that duplicate HTTP-header smuggling could bypass MOVEitISAPI.dll transaction restrictions and set attacker-controlled session variables. Those values reached vulnerable guest-access code, permitting creation of a sysadmin session, acquisition of an API token, and a path to remote code execution through resumable-upload metadata and unsafe .NET BinaryFormatter deserialization. Organizations were urged to apply Progress updates, restrict HTTP/HTTPS exposure until patched, hunt for human2.aspx, the Health Check Service account or session, and X-siLock-* headers, preserve logs, rotate relevant storage credentials, and rebuild compromised servers from trusted backups because patching alone does not remove persistence.