CVE-2024-5805: Authentication Bypass in MOVEit Gateway

The Authentication Bypass vulnerability in MOVEit Gateway allows an attacker to circumvent authentication mechanisms, effectively gaining access to the system without proper credentials. This could enable unauthorized data exfiltration, modification, or deletion. Successful exploitation could lead to a complete compromise of the MOVEit Gateway instance and potentially the underlying systems it connects to. Given MOVEit's role in secure file transfer, the potential impact is significant, particularly for organizations handling sensitive data like financial records, intellectual property, or personal information. The severity is amplified by the potential for lateral movement within the network if the Gateway is not properly segmented.

1. Reserved2024-06-10
2. Published2024-06-25
3. Modified2024-08-01
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-5805 is to immediately upgrade to MOVEit Gateway version 2024.0.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to the SFTP modules to trusted networks or users. Monitor SFTP logs for unusual activity and implement stricter authentication policies. Consider using a Web Application Firewall (WAF) to filter potentially malicious requests targeting the authentication endpoints. No specific Sigma or YARA rules are currently available, but monitoring for unusual authentication attempts is crucial.