Introduction
Overview
The MOVEit breach, discovered in May 2023, involved a vulnerability in the secure file transfer software MOVEit Transfer, widely used by businesses and government entities. The breach resulted from a SQL injection flaw that allowed attackers to gain unauthorized access to sensitive data stored within the MOVEit platform. Once inside, the attackers were able to extract files from the system, which potentially exposed personal, financial, and confidential information. The incident led to the disruption of operations for numerous organizations relying on MOVEit for secure file sharing.
Vulnerability Details
The attackers used a zero day vulnerability, was identified as a SQL injection, which occurs when malicious code is inserted into an SQL query through input fields, allowing attackers to manipulate the database. MOVEit Transfer’s lack of proper input sanitization and security controls enabled attackers to exploit the flaw and exfiltrate sensitive data.