Microsoft Exchange Zero-Days Enable Authenticated Remote Code Execution
Summary
Huntress reported two Exchange zero-days, CVE-2022-41040 and CVE-2022-41082, that can enable authenticated remote code execution. Microsoft had not released a patch, and Huntress reported no exploitation signs on partner devices.
Key points
- CVE-2022-41040 is a server-side request forgery vulnerability; CVE-2022-41082 allows authenticated attackers to execute arbitrary PowerShell.
- The SSRF flaw can be used to reach the RCE vulnerability; the attack requires an authenticated adversary.
- At publication, Microsoft had not released an official patch, and existing Exchange updates were reported as insufficient protection.
- Huntress recommended following containment steps published by GTSC. No public proof-of-concept scripts or exploitation tools were known at the time.
- Researcher Kevin Beaumont reported significant numbers of Exchange servers backdoored, including a honeypot; Shodan showed more than 1,200 potentially vulnerable endpoints.
- Huntress said it had found no signs of exploitation or indicators of compromise on partner devices. Microsoft Defender detections included Backdoor:ASP/Webshell.Y and Backdoor:Win32/RewriteHttp.A.
Article Details
- Vulnerability Types
- Server-side request forgery
- Remote code execution
- Severity
- Unknown
- Exploitation Status
- active
- Exploit Availability
- none_reported
- Patch Status
- unavailable
- Workarounds
- Follow the containment steps outlined in GTSC's post.
MITRE ATT&CK
CVE
People
Vendors
Products
Exchange OnlineKevin Beaumount has pointed out that there is still a risk to Exchange Online users, as a significant number may be running a hybrid server that migrated to Exchange Online and are still vulnerable to thisMicrosoft Defender Antimalware PlatformThe freely available Microsoft Defender antivirus will detect the current publicly known post-exploitation attempts as Backdoor:ASP/Webshell.Y and Backdoor:Win32/RewriteHttp.A.Microsoft Exchange ServerOn-prem Microsoft Exchange Server vulnerabilities are being actively exploited in the wild. Read our blog for Huntress' most up-to-date research and IOCs.