CVE-2023-34362

Related Files

MOVEit SQL Injection

Posted Jun 23, 2023

Authored by bwatters-r7, sfewer-r7, rbowes-r7 | Site metasploit.com

This Metasploit module exploits an SQL injection vulnerability in the MOVEit Transfer web application that allows an unauthenticated attacker to gain access to MOVEit Transfer's database. Depending on the database engine being used (MySQL, Microsoft SQL Server, or Azure SQL), an attacker can leverage an information leak be able to upload a .NET deserialization payload.

tags | exploit, web, sql injection

advisories | CVE-2023-34362

SHA-256 | b18ba528cf2f662442aa4037f5ec3d421c3b9cc9530694a34a9b358c25e66927

Download | Favorite | View

MOVEit Transfer SQL Injection / Remote Code Execution

Posted Jun 13, 2023

Authored by Horizon3 Attack Team | Site github.com

This proof of concept abuses an SQL injection vulnerability in MOVEit to obtain a sysadmin API access token and then use that access to abuse a deserialization call to obtain remote code execution. This proof of concept needs to reach out to an Identity Provider endpoint which hosts proper RS256 certificates used to forge arbitrary user tokens - by default this POC uses horizon3ai's IDP endpoint hosted in AWS. By default, the exploit will write a file to C:\Windows\Temp\message.txt. Alternative payloads can be generated by using the ysoserial.net project.

tags | exploit, remote, arbitrary, code execution, sql injection, proof of concept

systems | windows

advisories | CVE-2023-34362

SHA-256 | 891c1c3067e64d2916aec314b0195ba65fbc31db8570faee1f1fc3f6b4a366d9

Download | Favorite | View