MOVEit Transfer Authenticatie Omzeilings Vulnerabiliteit

Successful exploitation of CVE-2024-5806 allows an attacker to bypass authentication mechanisms within the MOVEit Transfer SFTP module. This means an attacker can potentially access sensitive data stored within the MOVEit Transfer system without proper credentials. The scope of data access depends on the attacker's privileges after bypassing authentication, but could include confidential documents, financial records, and personally identifiable information (PII). Lateral movement within the network is possible if the MOVEit Transfer server has access to other systems, allowing the attacker to compromise additional assets. Given MOVEit Transfer's role in secure file transfer, this vulnerability poses a significant risk to organizations handling sensitive data.

Organizations heavily reliant on MOVEit Transfer for secure file transfer, particularly those handling sensitive data such as financial records or PII, are at significant risk. Shared hosting environments where multiple customers share a MOVEit Transfer instance are also particularly vulnerable, as a compromise of one customer's account could potentially expose data for other customers.

• linux / server: Monitor /opt/moveit/domain/logs/moveit.log for authentication errors and unusual SFTP activity. Use journalctl -u moveit-transfer to review system logs for suspicious events.

journalctl -u moveit-transfer -f | grep "Authentication failed"

• generic web: Use curl to test SFTP endpoints with invalid credentials and observe the response. Look for responses that do not properly enforce authentication.

curl -v -u 'invalid_user:invalid_password' sftp://your-moveit-server/

• windows / supply-chain: Examine scheduled tasks related to MOVEit Transfer for any unusual or unauthorized entries. Use Get-ScheduledTask to list tasks and Get-ScheduledTaskInfo to examine details.

1. 2024-06-25Disclosure

   disclosure

1. Gereserveerd2024-06-10
2. Gepubliceerd2024-06-25
3. Gewijzigd2024-08-01
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2024-5806 is to immediately upgrade to version 2024.0.2 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds. Restrict access to the SFTP module to only authorized users and implement multi-factor authentication (MFA) where possible. Monitor MOVEit Transfer logs for suspicious activity, particularly failed login attempts and unusual file access patterns. Consider implementing a Web Application Firewall (WAF) with rules to detect and block attempts to exploit the authentication bypass. After upgrading, verify the fix by attempting to access the SFTP module with invalid credentials to confirm authentication is properly enforced.