CVE-2023-34362: MOVEit Transfer SQL Injection — CLOP's Mass Data Extortion Campaign

MOVEit Transfer's web application processes HTTP requests through endpoints that pass user-supplied input into SQL queries without adequate sanitization. An unauthenticated attacker sends crafted HTTP POST requests to MOVEit's HTTPS interface with SQL injection payloads that alter the intended query structure. The injected SQL accomplishes two objectives: authentication bypass (manipulating query logic to return records granting access) and privilege escalation to OS command execution through the database server's built-in file and command execution capabilities.

With code execution achieved, CLOP deployed a web shell named human2.aspx — a deliberate misspelling of a legitimate MOVEit file — to MOVEit's web root. This provided persistent access for ongoing file enumeration and download even after initial exploitation. CLOP used this access to systematically identify and exfiltrate the highest-value files stored or recently transferred through each compromised instance.

CLOP's MOVEit campaign was architecturally distinct from typical ransomware: rather than attacking individual organizations one by one, they targeted the platform used by hundreds of organizations to transfer their most sensitive files. A single vulnerability in MOVEit granted simultaneous access to the sensitive data of every organization running a vulnerable instance. The Memorial Day timing minimized immediate detection by security teams. The victim list reads like a cross-sector breach of extraordinary breadth: US Department of Energy, Shell, British Airways, the BBC, Boots, Aer Lingus, Maximus (11 million Medicaid/Medicare records), the Oregon DMV (3.5 million vehicle registration records), Louisiana OMV, University of California, Stanford University, and hundreds of others.

The companion vulnerabilities CVE-2023-35036 and CVE-2023-35708 were disclosed in June 2023, representing additional SQL injection flaws in the same product. Organizations that patched only CVE-2023-34362 remained exploitable until these separate patches were also applied.

Progress released patches June 1–6, 2023 depending on version. If you are still running unpatched MOVEit Transfer, treat the server as compromised and take it offline during remediation.

CVE-2023-34362 and the CLOP MOVEit campaign represent the maturation of supply chain targeting as a ransomware strategy. Rather than attacking individual organizations, CLOP exploited the platform used to move the most sensitive data — gaining simultaneous access to hundreds of organizations' crown jewels through a single vulnerability.

Data extortion without encryption is now a primary tactic for exactly this reason: it is immune to backup-based recovery, it creates regulatory and reputational pressure regardless of whether victims pay, and it requires no operational complexity beyond file collection. The only effective defense is preventing exfiltration — which means patching managed file transfer platforms immediately, monitoring for anomalous outbound data transfers, and treating these platforms as critical-risk infrastructure requiring the same rigor as production databases.