flawopen.com/Инциденты/MOVEit CVE-2023-34362

MOVEit Transfer: одна SQL-инъекция и тысячи взломанных корпораций

The lessons that actually transfer

• ✓Parameterise every query, without exception. SQL injection has been the best-understood vulnerability class in the industry for over two decades, and it still produced one of the largest breach events of 2023. Consistency is the control; a single concatenated query is enough.
• ✓Audit by pattern, not by report. When one SQL injection is found, the correct response is to grep the codebase for every instance of query concatenation. MOVEit's follow-up CVEs illustrate what happens when a class of bug is fixed one instance at a time.
• ✓Internet-facing file transfer products need an elevated bar. An MFT server aggregates other organisations' confidential data at a public endpoint. Treat that concentration of risk explicitly — segment it, monitor it, and minimise retention.
• ✓Delete what you no longer need. Much of the damage came from files sitting on MOVEit servers long after the transfers completed. Aggressive retention limits would have shrunk the loss substantially at no security-engineering cost.
• ✓Patching is not remediation after a web shell. Applying the fix closes the entry point but leaves persistence in place. Incident response had to include hunting for planted shells and rotating anything the attacker could reach.
• ✓Map your vendors' vendors. Many organisations were breached through a service provider's MOVEit instance without running MOVEit themselves.

FAQ

Related reading

• SQL Injection — full class reference across 11 languages
• Do stored procedures prevent SQL injection?
• CVE-2025-1094: when the escaping function itself was the vulnerability

Источники и официальные бюллетени

• Progress Software — security advisories and trust center
• NVD — CVE-2023-34362 detail
• CISA / FBI — joint advisory on Cl0p exploitation of MOVEit Transfer
• Unit 42 — threat brief on the MOVEit Transfer vulnerabilities
• Wiz — CVE-2023-34362 exploited in the wild
• CWE-89 — Improper Neutralization of Special Elements used in an SQL Command