MOVEit Transfer CVE-2023-34362 (SQL injection exploited by Cl0p, CISA KEV, advisory AA23-158A): how do I check an old or forgotten MOVEit server, patch it, and look for the LEMURLOOT web shell?

What it is: CVE-2023-34362 is a SQL injection flaw in the web application of Progress MOVEit Transfer, the managed file transfer product. In May-June 2023 the Cl0p group used it against thousands of organizations to install a web shell (LEMURLOOT) and steal stored files. Progress then fixed two more SQL injection bugs found in follow-up reviews (CVE-2023-35036 and CVE-2023-35708). It is in CISA's Known Exploited Vulnerabilities catalog, and unpatched or forgotten internet-facing MOVEit servers are still worth checking. Am I affected: - MOVEit Transfer 2023.0.0, 2022.1.x, 2022.0.x, 2021.1.x, 2021.0.x, 2020.1.x, 2020.0.x and older, unless the Progress patches for CVE-2023-34362 and the June 2023 follow-up CVEs are installed. MOVEit Cloud was patched by Progress. - Check the version in the MOVEit Transfer admin interface (or the installed program version on the Windows server) and compare it with the fixed-version table in Progress's advisory. Fix: 1. Upgrade to a currently supported MOVEit Transfer release (this also covers the 2023 follow-up CVEs). If you can't right away, Progress's interim step was to block HTTP and HTTPS traffic to the MOVEit Transfer server until patched. 2. Hunt for compromise before and after patching, as CISA and Progress advise: - In the MOVEit wwwroot folder, look for human2.aspx (the LEMURLOOT web shell) or any other unexpected .aspx files; the legitimate file is human.aspx, so compare carefully. - Look for unexpected administrator accounts in MOVEit and in its database, and unexplained large downloads in the MOVEit logs. - Use the YARA rules and indicators published in CISA advisory AA23-158A. 3. If you find signs of compromise: rebuild the server, remove unauthorized accounts, and reset MOVEit service account and user credentials (including database and Azure storage keys if used). Treat files that were stored on it as possibly stolen. Verify: the version matches a fixed release from the Progress advisory, no unknown .aspx files or admin accounts remain, and the server is no longer reachable from the internet beyond what's needed. Sources: https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-31May2023 https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a https://nvd.nist.gov/vuln/detail/CVE-2023-34362