CVE-2024-5806: MOVEit Automation Critical Authentication Bypass — Detection and Remediation

---
title: MOVEit Automation Web Server Spawning Shell
id: 89f3a12d-45b6-4f89-9123-aa456b78c9d1
status: experimental
description: Detects the MOVEit Automation web process (java.exe or eftserver.exe) spawning cmd.exe or powershell.exe, indicative of webshell activity or RCE.
references:
  - https://community.progress.com/s/article/ MOVEit-Automation-Critical-Authentication-Bypass-Vulnerability-CVE-2024-5806
author: Security Arsenal
date: 2024/09/17
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - '\MOVEit\'
      - '\Globalscape\'
      - 'EFTServer.exe'
      - 'java.exe' # MOVEit Automation often relies on Java components
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate administrative troubleshooting (rare)
level: high
---
title: Suspicious MOVEit Automation Administrative Access
id: 1b2c3d4e-5f6g-7h8i-9j0k-1l2m3n4o5p6q
status: experimental
description: Detects successful HTTP 200 responses to MOVEit Automation admin interfaces potentially indicative of successful auth bypass exploitation attempts.
references:
  - https://community.progress.com/s/article/MOVEit-Automation-Critical-Authentication-Bypass-Vulnerability-CVE-2024-5806
author: Security Arsenal
date: 2024/09/17
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
  product: moveit_automation
detection:
  selection:
    c-uri|contains:
      - '/admin'
      - '/api/v1/'
      - '/dmzweb/'
    sc-status: 200
  filter:
    c-useragent|contains:
      - 'Mozilla'
      - 'Progress-Software'
  condition: selection and not filter
falsepositives:
  - Valid administrative logins from internal IPs
  - Monitoring probes
level: medium

// Hunt for suspicious process spawns by MOVEit components
DeviceProcessEvents
| where Timestamp > ago(7d)
| where InitiatingProcessFolderPath has_any ("MOVEit", "Globalscape", "EFTServer", "Program Files\\Java") 
   and (ProcessVersionInfoOriginalFileName in ("cmd.exe", "powershell.exe", "pwsh.exe") 
        or FolderPath endswith @"\cmd.exe" 
        or FolderPath endswith @"\powershell.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, CommandLine
| extend AlertContext = "Potential RCE via MOVEit Automation"

// Correlate with network connections if possible (requires Syslog/CEF for web logs)
union isfuzzy=true 
(Syslog 
| where TimeGenerated > ago(24h) 
| where SyslogMessage contains "MOVEit" 
| where SyslogMessage has "200" 
| where SyslogMessage has_any ("/admin", "/api/v1") 
| project TimeGenerated, Computer, ProcessName, SyslogMessage)

-- Hunt for suspicious processes and file artifacts related to MOVEit Automation
SELECT 
  Pid, 
  Name, 
  CommandLine, 
  Exe, 
  Username, 
  ParentPid 
FROM pslist()
WHERE Exe =~ "MOVEit" 
   OR Exe =~ "EFTServer" 
   OR Exe =~ "Globalscape"

-- Cross-reference with suspicious child processes (like cmd/powershell)
LET SuspiciousChildren = SELECT Pid, Name, Exe, CommandLine, Parent.Pid AS ParentPid
FROM pslist()
WHERE Name =~ "cmd.exe" 
   OR Name =~ "powershell.exe"

SELECT 
  Parent.Name AS ParentProcess, 
  Child.Name AS ChildProcess, 
  Child.CommandLine
FROM foreach(row={
    SELECT Pid FROM pslist() WHERE Exe =~ "MOVEit" OR Exe =~ "EFTServer"
  }, 
  query={
    SELECT * FROM SuspiciousChildren WHERE ParentPid = _Pid
  })

# MOVEit Automation CVE-2024-5806 Vulnerability Audit Script
# Run as Administrator on the MOVEit Automation server

$ErrorActionPreference = "Stop"

Write-Host "[*] Checking for MOVEit Automation installation..."

# Common registry paths for MOVEit Automation (formerly Globalscape)
$registryPaths = @(
    "HKLM:\SOFTWARE\Wow6432Node\Progress\MOVEit Automation",
    "HKLM:\SOFTWARE\Wow6432Node\Globalscape\EFT Server",
    "HKLM:\SOFTWARE\Progress\MOVEit Automation"
)

$found = $false

foreach ($path in $registryPaths) {
    if (Test-Path $path) {
        $found = $true
        Write-Host "[+] Registry path found: $path"
        
        # Attempt to get version from registry
        $version = (Get-ItemProperty -Path $path -ErrorAction SilentlyContinue)."Version"
        
        # Fallback: Check executable file version if registry fails or is missing detail
        $installPath = (Get-ItemProperty -Path $path -ErrorAction SilentlyContinue)."Install Path"
        
        if (-not $version -and $installPath -and (Test-Path "$installPath\EFTServer.exe")) {
            $version = (Get-Item "$installPath\EFTServer.exe").VersionInfo.FileVersion
            Write-Host "[+] Version detected via EFTServer.exe: $version"
        } elseif ($version) {
            Write-Host "[+] Version detected via Registry: $version"
        }
        
        if ($version) {
            $v = [version]$version
            
            # Check against vulnerable ranges (CVE-2024-5806)
            # Affected: 2023 < 2023.0.2, 2022 < 2022.1.1, 2021 < 2021.1.3
            $isVulnerable = $false
            
            if ($v.Major -eq 2023 -and $v.Minor -eq 0 -and $v.Build -lt 2) { $isVulnerable = $true }
            if ($v.Major -eq 2022 -and $v.Minor -eq 1 -and $v.Build -lt 1) { $isVulnerable = $true }
            if ($v.Major -eq 2021 -and $v.Minor -eq 1 -and $v.Build -lt 3) { $isVulnerable = $true }
            # Older versions are assumed vulnerable
            if ($v.Major -lt 2021) { $isVulnerable = $true }

            if ($isVulnerable) {
                Write-Host "[!] ALERT: Vulnerable version of MOVEit Automation detected! (CVE-2024-5806)" -ForegroundColor Red
            } else {
                Write-Host "[OK] Version appears to be patched or not in the vulnerable range." -ForegroundColor Green
            }
        }
    }
}

if (-not $found) {
    Write-Host "[-] MOVEit Automation registry paths not found."
}