OWASSRF Exploit Bypasses Exchange Mitigations to Enable Remote Code Execution
Summary
Researchers reported that the OWASSRF exploit was used to bypass Microsoft’s ProxyNotShell mitigations and achieve remote code execution on vulnerable Exchange servers. Microsoft’s KB5019758 update fixes the vulnerabilities.
Key points
- The article says OWASSRF combines CVE-2022-41080 and CVE-2022-41082 to enable remote code execution through Outlook Web Access, bypassing ProxyNotShell URL rewrite mitigations.
- Researchers detected the exploit in the wild on December 20, 2022; the article attributes its use to the Play ransomware group.
- Affected products are Microsoft Exchange Server 2013, 2016, and 2019 versions before KB5019758.
- Microsoft released KB5019758 in November 2022. The article recommends installing it or a later update.
- If patching is delayed, the article recommends disabling OWA; it also suggests restricting remote PowerShell for non-administrative users and access to externally facing Exchange servers.
- The article reports that 80% of cloud environments using vulnerable Exchange products had patched their servers.
Article Details
- Vulnerability Types
- Server-side request forgery (SSRF)
- Remote code execution (RCE)
- Remote privilege escalation
- Severity
- CVE-2022-41080 is described as critical.
- Affected Versions
- Microsoft Exchange Server 2013 before KB5019758
- Microsoft Exchange Server 2016 before KB5019758
- Microsoft Exchange Server 2019 before KB5019758
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Disable OWA until the patch can be applied.
- Disable remote PowerShell for non-administrative users where possible.
- Restrict access to external-facing Exchange servers.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 179[.]60[.]149[.]28 | Listed as an initial-access indicator for detecting compromised Exchange servers. |
| IPV4 | 45[.]76[.]141[.]84 | Listed as an initial-access indicator for detecting compromised Exchange servers. |
| IPV4 | 45[.]76[.]143[.]143 | Listed as an initial-access indicator for detecting compromised Exchange servers. |
MITRE ATT&CK
T1059.001 · PowerShellThe article reports PowerShell spawned by IIS (w3wp.exe) and use of Remote PowerShell to execute arbitrary commands.T1069.002 · Domain GroupsAdFind was used to gather information from Active Directory.T1105 · Ingress Tool TransferBITSadmin is listed among the tools used by the group; the article does not specify its exact use.T1190 · Exploit Public-Facing ApplicationPlay used OWASSRF to exploit vulnerable, externally accessible Exchange servers through Outlook Web Access.
CVE
CVE-2022-41040which could allow remote code execution (RCE). These vulnerabilities were identified by Microsoft as CVE-2022-41040, a server-side request forgery (SSRF) vulnerability, and CVE-2022-41082, which allows RCE. TheseCVE-2022-41080This exploit combines CVE-2022-41080 and CVE-2022-41082 to enable remote code execution (RCE) through Outlook Web Access (OWA).CVE-2022-41082This exploit combines CVE-2022-41080 and CVE-2022-41082 to enable remote code execution (RCE) through Outlook Web Access (OWA).
Threat Actors
Malware
Hive ransomwarebeing the top target. Their tactics, techniques, and procedures (TTPs) are similar to those used by the Hive and Nokayawa ransomware families, including the use of AdFind, a command-line query tool used to gatherNokayawatop target. Their tactics, techniques, and procedures (TTPs) are similar to those used by the Hive and Nokayawa ransomware families, including the use of AdFind, a command-line query tool used to gather informationPlayDecember 20, 2022 – OWASSRF exploit detected in the wild, used by the Play ransomware group using CVE-2022-41080 and CVE-2022-41082 to enable RCE through Outlook Web Access.
Vendors
Products
Exchange OnlineExchange Online customers do not need to take any additional action as they are already protected.Microsoft Exchange ServerMicrosoft Exchange Server 2013 before KB5019758 Outlook on the webThis exploit combines CVE-2022-41080 and CVE-2022-41082 to enable remote code execution (RCE) through Outlook Web Access (OWA).
Tools
AdFind(TTPs) are similar to those used by the Hive and Nokayawa ransomware families, including the use of AdFind, a command-line query tool used to gather information from Active Directory. To execute arbitrarybitsadminby the ProxyNotShell exploit. Additional tools used by the group include Connectwise Screen Connect and BITSadmin. MimikatzTA0006 - Credential Access MimikatzOWASSRFA new exploit method, referred to as OWASSRF, has been discovered by researchers and exploited in the wild.ScreenConnectwas also exploited by the ProxyNotShell exploit. Additional tools used by the group include Connectwise Screen Connect and BITSadmin.