MoveIt Transfer vulnerability targeted amid disclosure drama

Vulnerability disclosure drama

Just prior to Progress Software's public disclosure of CVE-2024-5806 on Tuesday, cybersecurity vendor WatchTowr Labs revealed in a blog post that an anonymous source, who goes by the handle dav1d_b141ne, had previously published details about the vulnerability in an internet relay chat. According to a chat transcript sent to WatchTowr, dav1d_b141ne said that Progress Software was contacting customers regarding an improper authentication bypass vulnerability in its MoveIt Transfer product. The source stressed that advanced persistent threat groups and ransomware gangs might already be aware of the critical flaw.

The source also emphasized how Progress said the vulnerability can lead to authentication bypass only in "limited scenarios." Dav1d_b141ne provided WatchTowr with patched and unpatched instances of MoveIt Transfer.

While testing the vulnerability, WatchTowr researchers concluded that the issue involves two separate vulnerabilities: one in Progress MoveIt and one in a third-party library for IPWorks SSH server. WatchTowr described IPWorks as a "moderately popular commercial product, averaging 33 downloads a day." The library is used as part of MoveIt's authentication process. WatchTowr stressed that the vulnerability resulted from the interplay between MoveIt and IPWorks SSH, specifically a failure to handle an error condition.

WatchTowr researchers stressed that this type of vulnerability is not easily discoverable, and it remains unclear how Progress Software and dav1d_b141ne discovered it. WatchTowr applauded Progress Software on the condition that it found the vulnerability during a routine code review and analyzed the root cause.

"If this is indeed the case, we take our hats off to Progress for taking the issue as seriously as it deserves, and not attempting to sweep it under the rug, as we've seen other vendors do," WatchTowr wrote in blog. "On the other hand, we are somewhat troubled (could you guess) by the advisory's use of the term 'limited scenarios,' as we can't yet determine scenarios that could prevent trivial exploitation."

However, Progress Software has since removed 'limited scenarios' language from the advisory. The vendor did not respond to a request for comment regarding the language removal.

WatchTowr also applauded Progress Software's private disclosure process with customers that may have been ongoing for weeks or months. "We do not expect anyone to still be vulnerable due to the embargo, and the efforts taken proactively by Progress to ensure customers deployed patches," the blog said.

Ryan Emmons, lead security researcher at Rapid7, also addressed the vulnerabilities in an blog post published on Tuesday and warned exploitation could lead to an authentication bypass. While testing a vulnerable MoveIt Transfer instance, Emmons said Rapid7 researchers discovered three concerning risks.

"As of June 25, the known criteria for exploitation are threefold: that attackers have knowledge of an existing username, that the target account can authenticate remotely, and that the SFTP [Secure Managed File Transfer Product] service is exposed," Emmons wrote in the blog.

Emmons also warned that attackers might spray usernames to identify valid accounts and urged customers to install patches "on an emergency basis." He conducted a Shodan search that indicated there are around 1,000 public-facing MoveIt Transfer products and 70-public facing MoveIt Gateway instances. However, it's unclear how many remain vulnerable.

Emmons told TechTarget Editorial that it's essential for organizations to mitigate CVE-2024-5806 quickly since attacks put sensitive data at risk. "Based on our analysis, exploiting CVE-2024-5806 permits an attacker to bypass the usual account login process and directly gain unauthorized access to files on the sever," Emmons said.

Cailtin Condon, director of vulnerability research and intelligence at Rapid7, told TechTarget Editorial that the security vendor had not received reports of exploitation as of Wednesday.

"We have not seen exploitation directly, but third parties have reported attempts against cloud honeypots. We do not consider this totally confirmed exploitation, and this information is already in the blog. We will proactively let you know if MDR [managed detection and response] or [incident response] sees any exploitation that they can verify with high confidence."

Arielle Waldman is a news writer for TechTarget Editorial covering enterprise security.