# MOVEIt Transfer RCE Part Two (CVE-2023-34362)

Unauthenticated SQL injection in MOVEit Transfer's machine2/guestaccess path enables session forgery, API token theft, and .NET BinaryFormatter deserialization RCE.

- Payout: Real-world hack
- Severity: critical
- Program: MOVEit Transfer
- Credited: Assetnote
- Disclosed: 2025-02-12
- CVE: CVE-2023-34362
- Write-up quality: 9/10
- Original: https://www.assetnote.io/resources/research/moveit-transfer-rce-part-two-cve-2023-34362
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-moveit-transfer-rce-part-two-cve-2023-34362
- Tags: domain:web impact:mass-exploit impact:rce kind:incident platform:research sev:critical tech:dotnet technique:chained technique:param-pollution technique:source-review vuln:auth-bypass vuln:deserialization vuln:sqli

**Target:** MOVEitISAPI.dll / machine2.aspx / guestaccess.aspx / api/v1 resumable upload
**Root cause:** MOVEitISAPI.dll only checks the first X-siLock-Transaction header (folder_add_by_path) but forwards all headers, so a duplicate X-siLock-Transaction: session_setvars reaches machine2.aspx and sets unsanitized session vars; MyPkgAccessCode and MyPkgSelfProvisionedRecips are later concatenated into SQL. The resumable upload State field is deserialized with BinaryFormatter.
**Steps:**
1. Send `POST /MOVEitISAPI/MOVEitISAPI.dll?action=m2` with `XX-siLock-Transaction: folder_add_by_path` and `X-siLock-Transaction: session_setvars` to smuggle the transaction past the DLL check.
2. Set `X-siLock-SessVar6: MyPkgSelfProvisionedRecips: x' or 1=1) LIMIT 1; -- a` and `X-siLock-SessVar7: MyPkgAccessCode: 1'; update users set notes='pwned' where loginname='sysadmin'; -- a` to confirm stacked-query SQLi.
3. Insert a forged row into activesessions with SessionID matching a fresh ASP.NET_SessionId, Username from `(select username from users where loginname='sysadmin')`, InterfaceCode=6, IPAddress=127.0.0.1.
4. Request `POST /api/v1/token` with `grant_type=session` and the forged cookie to obtain a bearer token.
5. Create resumable upload via `POST /api/v1/folders/{id}/files?uploadType=resumable` with ysoserial.net BinaryFormatter payload in the `comments` field.
6. Run `update fileuploadinfo set state=comment where fileid='...'` via SQLi to copy the encrypted payload into State.
7. Trigger deserialization with `PUT /api/v1/folders/{id}/files?uploadType=resumable&fileId=...` to execute the payload.
**How found:** BinDiff showed no patch diff in MOVEitISAPI.dll, so SQLi was elsewhere; code review found the DLL only validates the first X-siLock-Transaction header while forwarding all headers, enabling header smuggling to reach the removed session_setvars path; dnSpy tracing of session vars led to unsanitized concatenation in guestaccess.aspx and the MsgPostForGuest query; debugger stepping past CSRF and recipient checks; DBFieldEncrypt reuse found by grepping for encryption calls.
**Exploitation:** Unauthenticated attacker smuggles session_setvars through MOVEitISAPI, injects stacked SQL to forge an activesessions row, exchanges it for an API bearer token via grant_type=session, then abuses resumable upload to plant a BinaryFormatter payload in the encrypted State column (copied from Comment) and triggers deserialization for RCE as the MOVEit service account.
**Escalation:** SQLi -> session forgery -> API token -> authenticated resumable upload -> BinaryFormatter deserialization RCE; used by Cl0p in mass exploitation.
**Insight:** When a front-end proxy validates only the first occurrence of a header but forwards duplicates, smuggle a second header to reach backend-only code paths; and when a sink requires encrypted input, find an app endpoint that encrypts attacker-controlled data (e.g. Comment) and copy it via SQLi into the target column (State).