<\/div>\n

Experts warn of active exploitation of a critical authentication bypass vulnerability in MOVEit Transfer file transfer software.<\/h2>\n\n\n\n

Progress Software addressed two critical authentication bypass vulnerabilities, tracked as CVE-2024-5805<\/a>\u00a0and\u00a0CVE-2024-5806<\/a>, affecting its MOVEit Transfer file transfer software.<\/gwmw><\/p>\n\n\n\n

The vulnerability CVE-2024-5805<\/a> (CVSS score 9.1) is an improper authentication vulnerability in Progress MOVEit Gateway (SFTP module) that allows authentication bypass. The vulnerability was discovered by Max Hase, it impacts MOVEit Gateway: 2024.0.0.<\/p>\n\n\n\n

The vulnerability\u00a0CVE-2024-5806<\/a> (CVSS score 9.1) is also an improper authentication vulnerability that resides in the Progress MOVEit Transfer (SFTP module) that can lead to authentication bypass.<\/p>\n\n\n\n

This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.<\/gwmw>
<\/gwmw><\/p>\n\n\n\n

The flaw CVE-2024-5806 was addressed with the release of versions 2023.0.11, 2023.1.6, and 2024.0.2. CVE-2024-5805 has been addressed with the release of version 2024.0.1.\u00a0<\/p>\n\n\n\n

Progress highlighted that a recently discovered vulnerability in a third-party component raises the risk level for this CVE.<\/gwmw><\/p>\n\n\n\n

“We have addressed the MOVEit Transfer vulnerability and the Progress\u202fMOVEit\u202fteam strongly recommends performing an upgrade to the latest version listed in the table below.” reads the advisory<\/strong><\/a> published Progress Software. “A newly identified vulnerability in a third-party component used in MOVEit Transfer elevates the risk of the original issue mentioned above if left unpatched. While the patch distributed by Progress on June 11th successfully remediates the issue identified in CVE-2024-5806, this newly disclosed third-party vulnerability introduces new risk. Please work with your internal teams to take the following steps to mitigate the third-party vulnerability.”<\/em><\/p>\n\n\n\n

The company recommends customers mitigate third-party vulnerability by verifying they have blocked public inbound RDP access to MOVEit Transfer server(s), and limiting outbound access to only known trusted endpoints from MOVEit Transfer server(s).<\/p>\n\n\n\n

Experts warned of exploitation attempts targeting the vulnerability CVE-2024-5806.<\/gwmw><\/p>\n\n\n\n

WatchTowr researchers published a detailed analysis of the flaw CVE-2024-5806, they added that Progress has been proactively contacting customers for weeks or months to ensure they address the CVE-2024-5806. <\/gwmw><\/p>\n\n\n\n

“Clearly, this is a serious vulnerability. It is also somewhat difficult to diagnose, given the knowledge of the SSH protocol and a considerable .NET reverse-engineering effort required.” reads the advisory<\/a> published by WatchTowr. “However, the presence of the\u00a0Illegal characters in path<\/code>\u00a0exception should grab the attention of any other researchers who are searching for the vulnerability, and the relative simplicity of exploitation lends itself to \u2018accidental\u2019 discovery.”<\/em><\/p>\n\n\n\n

Researchers at Shadowserver Foundation also reported observing exploitation attempts<\/a>\u00a0for CVE-2024-5806 and urge customers to address it.<\/p>\n\n\n\n

\n

Very shortly after vulnerability details were published today we started observing Progress MOVEit Transfer CVE-2024-5806 POST \/guestaccess.aspx exploit attempts. If you run MOVEit & have not patched yet – please do so now: https:\/\/t.co\/AenLgqg1wM<\/a>

NVD: https:\/\/t.co\/OHQRNFNE9p<\/a><\/p>— The Shadowserver Foundation (@Shadowserver) June 25, 2024<\/a><\/blockquote>