Loading vulnerability…
SFTP Authentication Bypass in Progress MOVEit Transfer
CVE-2024-5806 is an improper authentication vulnerability in the SFTP module of Progress MOVEit Transfer. Improper handling of SSH public-key authentication allows an attacker to impersonate an existing user without legitimate credentials. An exploitation technique supplies a file path instead of a public key, causing the server to read an attacker-crafted key from its own logs. Affected versions are 2023.0.0 through versions before 2023.0.11, 2023.1.0 through versions before 2023.1.6, and 2024.0.0 through versions before 2024.0.2. Successful exploitation can expose sensitive files to unauthorized reading, modification, and deletion. Although initially described as applicable in limited scenarios, vulnerable default configurations have been demonstrated.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Remote, unauthenticated attackers can impersonate valid MOVEit Transfer users and access, steal, modify, or delete sensitive data. Username enumeration can assist in identifying target accounts. A publicly released exploit chain was also reported to expose Windows service-account credentials through forced authentication, but whether that behavior belongs to CVE-2024-5806 or a separate third-party vulnerability remained unclear. Exploitation in the wild has been reported.
If you can’t patch tonight, do this now.
Restrict network access to the SFTP service and enforce least privilege. Block public inbound RDP access to MOVEit Transfer servers and limit outbound connections to known trusted endpoints, particularly protocols capable of automatic Windows authentication such as SMB. Deploy intrusion-prevention or virtual-patching controls capable of blocking exploitation patterns. Monitor SFTP authentication logs for empty public-key fingerprints, certificate-store access failures, unusual key validation patterns, and authentication denials followed by key validation. These events can also arise from benign conditions and require investigation; these controls do not replace patching.
Patch, then assume compromise.
Apply Progress updates on an emergency basis. Upgrade the 2023.0 branch to 2023.0.11 or later, the 2023.1 branch to 2023.1.6 or later, or the 2024.0 branch to 2024.0.2 or later. Back up systems before applying updates and verify that remediation is complete. Progress stated that MOVEit Cloud customers had already been patched.
3 exploits validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.