MOVEit Transfer
A managed file transfer server for sharing files securely.
Where It Sits
The small stack marks its layer. Beside it, each related technology links to its own page.
- AppMOVEit Transfer
- Framework
- Web Server
- Runtime
- Containers
- OS
- Hypervisor
- Firmware
- Hardware
- Data
About
MOVEit Transfer moves files between organisations with auditing and encryption. It is an ASP.NET application on Windows Server and IIS, with its web interface at /human.aspx. Because it sits on the edge of the network and handles sensitive files, a flaw in it is valuable to attackers.
How to Spot It
These are signs that a system runs MOVEit Transfer, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.
- Path
/human.aspx- Path
/machine.aspx- Cookie
ASP.NET_SessionId
If It Has a Flaw
MOVEit sits on the network edge and handles files from many partners, so one flaw can expose every file in transit, as the 2023 attacks showed.
A flaw exposes the data it keeps.
- Data
SQL Server
Well-Known Flaws
Each flaw has a CVE id, the unique number a publicly known vulnerability is given so that every advisory names the same flaw. The id links to the advisory, and the card says what the flaw let an attacker do and how far it reached because of where MOVEit Transfer sits.
CVE-2023-34362 (opens in a new tab)2023
MOVEit SQL Injection
A SQL injection flaw gave unauthenticated attackers access to the MOVEit database.
Reach It exposed files and let attackers run code on internet-facing transfer servers, which led to data theft from many organisations.
Stacks and Code
Its code arrives from the sources listed, and each source's page says how bad code could get in through it.
- Its Code Comes From
- Vendor Updates