External risk intelligence

Progress MOVEit Gateway SFTP Authentication Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2024-5805

MOVEit Gateway is specifically designed to function as an edge proxy and secure gateway for managed file transfer services. As an internet-facing component intended to handle external SFTP connections, it is deployed by design to be exposed to the public network to facilitate secure data exchange.

Authentication Bypass

Progress Moveit Gateway

2024.0

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Progress MOVEit Gateway's SFTP modules could allow unauthorized access, bypassing authentication. This affects the 2024.0 version of MOVEit Gateway, potentially exposing sensitive information.

Unauthorized access bypasses system authentication.
Protects critical data transfer pathways.
Verify MOVEit Gateway usage and exposure.

Attack Path

How an attacker could exploit the issue

An attacker could bypass authentication in MOVEit Gateway's SFTP modules by exploiting an improper authentication vulnerability. This exposure allows unauthenticated access to the system.

Network access required.
Unauthenticated SFTP connection.
Sensitive data exposure and modification.

Live Threat

Current exploitation, exposure, and threat context

This Improper Authentication vulnerability in Progress MOVEit Gateway could allow an unauthenticated attacker to bypass authentication. When supported by the advisory, this could expose sensitive information or allow unauthorized modification of data.

System and user data at risk.
Authentication bypass via network access.
Unauthorized access and data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Progress MOVEit Gateway is a critical component for secure file transfers, often managed by infrastructure or platform teams responsible for shared services. Given its role as an SFTP module, the first step is to confirm its presence within your environment, assess its external reachability and business criticality, identify the accountable owner, and then prioritize remediation based on the assessed risk.

Infrastructure or platform team ownership.
Verify external reachability and business criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Progress MOVEit Gateway?

Progress MOVEit Gateway acts as an edge proxy and secure buffer for managed file transfer services. By sitting between external clients and internal file transfer infrastructure, it centralizes how SFTP connections are handled, ensuring data exchanges are isolated and controlled.

How does CVE-2024-5805 allow authentication bypass?

This vulnerability is classified as Improper Authentication (CWE-287). It means the software's SFTP module fails to correctly verify the identity of a connecting user, allowing an attacker to interact with the system as if they had already successfully logged in.

What triggers this authentication bypass?

The flaw is triggered during an SFTP connection attempt to the affected gateway. An attacker does not need legitimate credentials to exploit this; simply initiating a network connection to the vulnerable module is sufficient. Standard, authenticated user sessions are not required to activate this defect.

Is my instance at risk according to Halo Surface Signal?

Because MOVEit Gateway is designed as an internet-facing edge proxy to facilitate public SFTP access, Halo Surface Signal identifies it as highly likely to be exposed. If your instance is reachable from the public network, it is within the primary scope of this threat.

Do I need to update my MOVEit Gateway installation?

Yes. First, confirm if you are running version 2024.0.0, as that is the specific version affected. Reach out to your infrastructure team to verify the gateway's external accessibility, determine the business impact, and follow the vendor's guidance to apply the necessary security updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.