CVE-2024-5806: MOVEit Automation Critical Auth Bypass — Detection and Hardening Guide

---
title: MOVEit Automation Service Spawning Shell
id: 8a4b2c19-0d72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects the MOVEit Automation service process spawning cmd.exe or powershell.exe, indicating potential post-exploitation activity or webshell execution.
references:
 - https://progress.com/moveit-transfer/security-advisories
author: Security Arsenal
date: 2024/06/12
tags:
  - attack.initial_access
  - attack.execution
  - cve-2024-5806
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains: '\MOVEitAutomation\'
    ParentImage|endswith:
      - '\tmservice.exe'
      - '\DMZServer.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: all of selection*
falsepositives:
  - Legitimate administrative debugging (rare)
level: critical
---
title: MOVEit Automation Anomalous Admin Access
id: 9c5d3e20-1e83-5f4b-bc12-3e5a8f901234
status: experimental
description: Detects successful authentication to MOVEit Automation web interface followed immediately by sensitive administrative modifications, useful for spotting bypass exploits.
references:
 - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2024/06/12
tags:
  - attack.defense_evasion
  - attack.persistence
logsource:
  category: webserver
  product: moveit_automation
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/admin'
      - '/api/v1/user'
      - '/api/v1/configuration'
  selection_status:
    sc-status: 200
  condition: all of selection_*
falsepositives:
  - Legitimate administrator configuration changes
level: high

// Hunt for suspicious administrative access patterns in MOVEit Automation
// Note: Adjust the 'ServiceName' and 'LogSource' based on your specific ingestion (IIS, Syslog, or CEF)
DeviceNetworkEvents
| where RemotePort == 443 
| where Url contains "moveit" 
| where Url contains "/admin" or Url contains "/api/v1"
| where ActionType == "ConnectionAccepted" or InitiatingProcessFileName == "java.exe"
| summarize Count = count(), ConnectionTimes = make_list(TimeGenerated), IPs = make_list(RemoteIP) by DeviceName, Url
| where Count > 10 // Threshold for anomaly detection
| project DeviceName, Url, Count, IPs, ConnectionTimes

-- Hunt for MOVEit Automation process anomalies
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'tmservice'
   OR Name =~ 'DMZServer'
;

-- Check for unexpected child processes spawned by MOVEit
SELECT Parent.Name AS ParentProcess, Child.Name, Child.CommandLine, Child.Pid
FROM pslist(pid=ParentPid)
LEFT JOIN pslist() AS Child ON Child.Ppid = Parent.Pid
WHERE Parent.Name =~ 'tmservice'
  AND Child.Name NOT IN ('tmservice.exe', 'conhost.exe', 'svchost.exe')

<#
.SYNOPSIS
    Check MOVEit Automation Version for CVE-2024-5806 vulnerability.
.DESCRIPTION
    This script checks the installed version of MOVEit Automation against vulnerable ranges.
#>

$vulnerableVersions = @(
    @{Name="2023.0.0"; Fixed="2023.0.6"},
    @{Name="2023.1.0"; Fixed="2023.1.4"},
    @{Name="2024.0.0"; Fixed="2024.0.2"}
)

# Common installation paths
$paths = @(
    "C:\Program Files (x86)\Progress\MOVEit Automation\",
    "C:\Program Files\Progress\MOVEit Automation\",
    "C:\Program Files (x86)\Tumbleweed\SecureTransport\"
)

$found = $false

foreach ($path in $paths) {
    if (Test-Path $path) {
        $found = $true
        Write-Host "[+] Found MOVEit installation at: $path" -ForegroundColor Cyan
        
        # Attempt to get version from executable (tmservice.exe is a common binary)
        $exePath = Join-Path -Path $path -ChildPath "tmservice.exe"
        
        if (Test-Path $exePath) {
            $versionInfo = (Get-Item $exePath).VersionInfo
            $fileVersion = "$($versionInfo.FileMajorPart).$($versionInfo.FileMinorPart).$($versionInfo.FileBuildPart).$($versionInfo.FilePrivatePart)"
            
            Write-Host "    Current Version: $fileVersion" -ForegroundColor Yellow
            
            # Simple check logic (Adjust based on exact FileVersion string returned)
            if ([version]$fileVersion -lt [version]"2024.0.2" -and [version]$fileVersion -ge [version]"2024.0.0") {
                Write-Host "    [ALERT] Vulnerable to CVE-2024-5806. Upgrade to 2024.0.2 or later." -ForegroundColor Red
            }
            elseif ([version]$fileVersion -lt [version]"2023.1.4" -and [version]$fileVersion -ge [version]"2023.1.0") {
                Write-Host "    [ALERT] Vulnerable to CVE-2024-5806. Upgrade to 2023.1.4 or later." -ForegroundColor Red
            }
            elseif ([version]$fileVersion -lt [version]"2023.0.6" -and [version]$fileVersion -ge [version]"2023.0.0") {
                Write-Host "    [ALERT] Vulnerable to CVE-2024-5806. Upgrade to 2023.0.6 or later." -ForegroundColor Red
            }
            else {
                Write-Host "    [INFO] Version appears patched or out of scope." -ForegroundColor Green
            }
        } else {
            Write-Host "    [WARN] Could not find tmservice.exe to verify version." -ForegroundColor DarkYellow
        }
    }
}

if (-not $found) {
    Write-Host "[INFO] No MOVEit Automation installation found in standard paths." -ForegroundColor Gray
}