VulnerabilitycriticalExploited in the wild

Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (ProxyNotShell)

Palo Alto Unit 42by Shawn WestfallJun 5, 2024 · 17:51 UTC (Jun 5, 2024)9 min read2

Read at unit42.paloaltonetworks.com

Analyze CVE-2022-41040 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2022-41040 CVE-2022-41082 CVE-2021-34473 CVE-2021-34523 CVE-2021-31207

Tags: cve-2022-41040 cve-2022-41082 cve-2021-34473 cve-2021-34523 cve-2021-31207 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-31207	Security feature bypass in Microsoft Exchange Server (ProxyShell) enables webshell RCE	6.6	100%	KEVRansomwarePoC	May 11, 2021 KEV Nov 3, 2021
CVE-2021-34473 +1 related CVE CVE-2021-34523	SSRF (CWE-918) in Microsoft Exchange Server Enabling RCE (ProxyShell)	9.1 group max	100%	KEVRansomwarePoC	Jul 14, 2021 KEV Nov 3, 2021
CVE-2022-41040 +1 related CVE CVE-2022-41082	Server-Side Request Forgery in Microsoft Exchange Server (ProxyNotShell)	8.8 group max	100%	KEVRansomwarePoC	Oct 3, 2022 KEV Sep 30, 2022

From the original article

9 min read at unit42.paloaltonetworks.com

In early August, GTSC discovered a new Microsoft Exchange zero-day remote code execution (RCE) that was very similar to ProxyShell (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207). The exploit was discovered in the wild in what appeared to be a SOC investigation into suspicious activity of one of GTSC’s customers.

Palo Alto Unit 42

By Shawn Westfall · unit42.paloaltonetworks.com

Read the full article at Palo Alto Unit 42

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.