# MOVEit Transfer Critical Vulnerability CVE-2023-34362

Unauthenticated SQL injection in MOVEit Transfer's moveitisapi.dll let attackers deploy human2.aspx webshell, leak files, and achieve RCE as moveitsvc, exploited by cl0p ransomware.

- Payout: Real-world hack
- Severity: critical
- Program: MOVEit Transfer
- Credited: Huntress
- Disclosed: 2023-06-01
- CVE: CVE-2023-34362, CVE-2023-35036
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-moveit-transfer-critical-vulnerability-rapid-response
- Tags: domain:web impact:data-leak impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:dotnet technique:chained vuln:file-upload vuln:rce vuln:sqli

**Target:** MOVEit Transfer web frontend (moveitisapi.dll, guestaccess.aspx, API v1)
**Root cause:** SQL injection in moveitisapi.dll when requested with specific headers, reachable unauthenticated via the web frontend; guestaccess.aspx prepares sessions and CSRF tokens to chain further actions.
**Steps:**
1. `POST /guestaccess.aspx` to establish session and harvest CSRF token/field values
2. `POST /api/v1/token` then `GET /api/v1/folders` to enumerate folders
3. `POST /api/v1/folders/605824912/files?uploadType=resumable` then `PUT ...&fileId=963061209` to stage file
4. `POST /moveitisapi/moveitisapi.dll action=m2` with crafted headers to trigger SQLi
5. `POST /machine2.aspx` from localhost (CWinInetHTTPClient) to compile staged ASPX via csc.exe
6. `GET /human2.aspx` with correct `X-siLock-Comment` password header to activate backdoor
**How found:** Huntress reviewed IIS access logs of an affected host, spotting the sequence of guestaccess.aspx, api/v1/token, folder/file upload, moveitisapi.dll action=m2, and localhost machine2.aspx calls, then correlated w3wp.exe spawning csc.exe and a second App_Web_*.dll in Temporary ASP.NET Files to reconstruct the chain.
**Exploitation:** Unauthenticated attacker chains guestaccess.aspx session prep, API folder/file upload, and SQLi in moveitisapi.dll to write human2.aspx into wwwroot; w3wp.exe invokes csc.exe to precompile it, yielding a webshell gated by X-siLock-Comment password. Headers X-siLock-Step1/2/3 select actions: leak Azure info and GZIP all files/owners/sizes, retrieve arbitrary files by folder/file ID, add a 'Health Check Service' admin user, or delete a user. Code runs as moveitsvc (local admin), enabling AV disable and cl0p ransomware detonation.
**Escalation:** SQLi -> arbitrary file write -> ASPX webshell -> code execution as moveitsvc local admin -> AV disable -> ransomware; also DB admin user creation for persistence and full file exfiltration.
**Insight:** When a file-transfer appliance exposes both a legacy ISAPI DLL (moveitisapi.dll) and a modern REST API, watch for the legacy endpoint being used to bridge SQLi into file writes; also treat a second App_Web_*.dll in Temporary ASP.NET Files as a webshell-compilation artifact.