Vulnerabilidade de Ignorar Autenticação no MOVEit Gateway

The Authentication Bypass vulnerability in MOVEit Gateway allows an attacker to circumvent authentication mechanisms, effectively gaining access to the system without proper credentials. This could enable unauthorized data exfiltration, modification, or deletion. Successful exploitation could lead to a complete compromise of the MOVEit Gateway instance and potentially the underlying systems it connects to. Given MOVEit's role in secure file transfer, the potential impact is significant, particularly for organizations handling sensitive data like financial records, intellectual property, or personal information. The severity is amplified by the potential for lateral movement within the network if the Gateway is not properly segmented.

Organizations heavily reliant on MOVEit Gateway for secure file transfers, particularly those handling sensitive data such as financial institutions, healthcare providers, and government agencies, are at significant risk. Those using MOVEit Gateway in cloud environments or shared hosting configurations should be especially vigilant, as these deployments may have increased exposure.

• linux / server: Monitor /opt/moveit/gateway/logs/moveit.log for authentication errors or unusual login patterns. Use journalctl -u moveit-gateway to check for related errors.

journalctl -u moveit-gateway | grep -i "authentication failed"

• generic web: Use curl to test SFTP endpoints with invalid credentials and observe the response. Look for responses that do not properly enforce authentication.

curl -v -u 'invalid_user:invalid_password' sftp://your_moveit_gateway_ip/  # Check for successful connection despite invalid credentials

1. 2024-06-25Disclosure

   disclosure

1. Reservado2024-06-10
2. Publicada2024-06-25
3. Modificada2024-08-01
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2024-5805 is to immediately upgrade to MOVEit Gateway version 2024.0.1 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting access to the SFTP modules to trusted networks or users. Monitor SFTP logs for unusual activity and implement stricter authentication policies. Consider using a Web Application Firewall (WAF) to filter potentially malicious requests targeting the authentication endpoints. No specific Sigma or YARA rules are currently available, but monitoring for unusual authentication attempts is crucial.