IPS Protection for MOVEit Transfer SQL Injection (CVE-2023-34362)

[Alex_Lewis]

I am curious what metrics Check Point used for the "MOVEit Transfer SQL Injection (CVE-2023-34362)" IPS protection. The only thing it seems effective at is stopping any and all uploads through the MoveIt Transfer web portal, including non-malicious file uploads to a patched MoveIt Transfer server.

[Chris_Atkinson]

Would recommend raising a TAC case to investigate further.

https://help.checkpoint.com

Refer also:

https://advisories.checkpoint.com/defense/advisories/public/2023/cpai-2023-0386.html/

[alec_dalessandr]

@Alex_Lewis 

Was there any response or follow up with with, just curious as to what it actually blocks as well. As we have it enabled, in the IPS protectors.

-Alec D'Alessandro

[Chris_Atkinson]

Note the resource linked above indicates the corresponding IPS protection was last updated a week after my original post. 

Suggest discussing further with TAC or your SE if its important to you however I suspect additional insights will be somewhat restricted/limited.