---
A new vulnerability, dubbed CVE-2023-30394, has been discovered in Progress Ipswitch MoveIT 1.1.11, a popular file transfer solution used across various industries. The vulnerability is classified as a Cross-Site Scripting (XSS) issue that can be exploited through the API authentication function. This post will delve into the details of this vulnerability, including code snippets, links to original references, and details about the exploitation process. To ensure better understanding, the text will be written in simple American English.

Background on Progress Ipswitch MoveIT

---
Progress Ipswitch MoveIT is a secure managed file transfer (MFT) solution, widely used by organizations worldwide to manage sensitive data transfers. It provides businesses with a centralized location to oversee and manage the process of file transfer securely and efficiently. For more information about the product, you can visit the official website here.

Cross-Site Scripting (XSS) Vulnerability

---
Cross-Site Scripting, or XSS, is a web application vulnerability where an attacker injects malicious code (usually JavaScript) into a vulnerable web application. The web application then unknowingly serves this malicious code to the users visiting the site. The attacker can then perform various malicious actions, such as stealing user session information, defacing the website, or redirecting users to malicious websites. For more information about XSS, you can refer to OWASP's guide.

CVE-2023-30394 Overview

---
This vulnerability affects the API authentication function in Progress Ipswitch MoveIT 1.1.11, allowing an attacker to inject malicious scripts through the API, which would be stored and executed when a user interacts with the affected application. The successful exploitation of this vulnerability can result in unauthorized access to sensitive data, loss of data integrity, and even a compromised system.

Code Snippet

---
The following code snippet demonstrates the injection of a malicious script into the API authentication function:

var xhttp = new XMLHttpRequest();
xhttp.onreadystatechange = function() {
    if (this.readyState == 4 && this.status == 200) {
       console.log("Malicious script injected");
    }
};
xhttp.open("POST", "https://TARGET_MOVEIT_API/authenticate";, true);
xhttp.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
xhttp.send("username=<script>alert('XSS')</script>&password=PASSWORD");

Replace 'TARGET_MOVEIT_API' with the target MoveIT API's URL and 'PASSWORD' with the user's actual password to test the code snippet.

Exploit Details

---

Craft a malicious payload to inject into the API authentication function.

3. Use social engineering techniques, such as phishing emails or malicious websites, to trick users into interacting with the affected application, thereby executing the malicious script.
4. Harvest user information, manipulate data, deface webpages, or perform other malicious activities, as enabled by the injected script.

Mitigation Measures

---
Progress has released an updated version of MoveIT version 1.1.12, which addresses this vulnerability. It is advisable for organizations running vulnerable versions of MoveIT to update their installations immediately. In addition, following secure coding practices and implementing security measures such as Content Security Policy (CSP) can further help defend against XSS attacks.

Conclusion

---
CVE-2023-30394 highlights the potential risks associated with using outdated software and not following secure coding practices. It underscores the importance of keeping software up-to-date and maintaining awareness of known vulnerabilities and their potential impact on an organization's IT infrastructure. Regular patching, monitoring, and taking proper security measures can go a long way in ensuring the safety of an organization's systems and sensitive data.

Timeline

Published on: 05/11/2023 19:15:00 UTC
Last modified on: 06/02/2023 04:15:00 UTC