In a blog post, Vietnamese security company GTSC noted that they saw evidence of a new “ProxyShell” like vulnerability being exploited in the wild. The evidence came from compromised Exchange servers GTSC observed when responding to incidents [1]. Later, Trend Micro confirmed that two vulnerabilities tracked by Trend Micro’s zero-day initiative were involved in the compromise described by GTSC [2]. Trend Micro had reported the vulnerabilities to Microsoft about a month ago.
Microsoft has now published a blog post with its own guidance [3]
Microsoft identified two vulnerabilities as contributing to the recent incidents:
CVE-2022-41040: A Server Side Request Forgery (SSRF) issue.
CVE-2022-41082: A remote code execution (RCE) issue.
The SSRF vulnerability can be used to trigger the RCE vulnerability. An attacker does need to be authenticated to exploit the SSRF vulnerability.
No patch is available if you run Microsoft Exchange on premise, but you can use URL rewrite rules to prevent exploitation. Post exploitation, rules in Microsoft Sentinel and Microsoft Defender for Endpoint can be used to detect webshells and HTTP rewrite payloads installed by attackers.
There is no word as to a possible patch being released early. But the URL rewrite workaround should be sufficient for now. And please make sure all available patches are applied. Microsoft Exchange servers are a top target for attackers these days.
[1] https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
[2] https://success.trendmicro.com/dcx/s/solution/000291651?language=en_US
[3] https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/
—
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.
Photo Credit:
English: New “Zero Day Kill Chain” model is based on 3 steps and describes hacker attacks
Date 1 February 2022
Source Own work
Author Swissinventor
Licensing
I, the copyright holder of this work, hereby publish it under the following license:
w:en:Creative Commons
attribution share alike
This file is licensed under the Creative Commons Attribution-Share Alike 4.0 International license.
You are free:
to share – to copy, distribute and transmit the work
