MOVEit Transfer SQL Injection / Remote Code Execution

This proof of concept abuses an SQL injection vulnerability in MOVEit to obtain a sysadmin API access token and then use that access to abuse a deserialization call to obtain remote code execution. This proof of concept needs to reach out to an Identity Provider endpoint which hosts proper RS256 certificates used to forge arbitrary user tokens - by default this POC uses horizon3ai's IDP endpoint hosted in AWS. By default, the exploit will write a file to C:\Windows\Temp\message.txt. Alternative …

abuse access access token api call certificates code code execution concept deserialization endpoint identity identity provider injection moveit moveit transfer remote code remote code execution sql sql injection sysadmin token transfer vulnerability