Threat Brief: OWASSRF Vulnerability Exploitation
Unit 42 details active exploitation of Exchange SSRF flaws CVE-2022-41080/CVE-2022-41082 via the OWASSRF method, deploying the SilverArrow PowerShell backdoor.
Unit 42 documents OWASSRF, an exploit chain combining CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution on Microsoft Exchange via Outlook Web Access, bypassing Microsoft's ProxyNotShell mitigations. Active exploitation was observed in late November and early December 2022, affecting at least eight organizations. Attackers authenticated to Exchange, then executed a PowerShell backdoor tracked as SilverArrow to create admin accounts, install AnyDesk, tunnel RDP via PuTTY Link, and dump LSASS memory for credential theft. Exploitation is isolated rather than mass-scale because authentication is required.
- OWASSRF chains CVE-2022-41080 and CVE-2022-41082 for RCE via OWA
- Bypasses Microsoft mitigations previously issued for ProxyNotShell
- Requires prior authentication, so exploitation is isolated, not mass-scale
- SilverArrow PowerShell backdoor creates admins, installs AnyDesk, dumps LSASS
- At least eight organizations observed with exploitation activity
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1059.001 Command and Scripting Interpreter: PowerShellT1136.002 Create Account: Domain AccountT1021.001 Remote Services: Remote Desktop Protocol
- Vendors
- Microsoft
- Threat actors
- SilverArrow
- Malware
- SilverArrow
- Organizations
- Palo Alto NetworksUnit 42CrowdStrike
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2022-41040+1 related CVE | Server-Side Request Forgery in Microsoft Exchange Server (ProxyNotShell) | 8.8 group max | 100% | KEVRansomwarePoC | KEV |
| CVE-2022-41080 | Microsoft Exchange Server Privilege Escalation Exploited in Ransomware Campaigns | 8.8 | 77% | KEVRansomware | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 140.82.52.35 | kdoors: 216.128.146[.]38 95.179.162[.]125 192.248.176[.]138 140.82.52[.]35 45.32.144[.]71 Several of our XDR customers experienced e |
| ipv4 | 192.248.176.138 | vers for these backdoors: 216.128.146[.]38 95.179.162[.]125 192.248.176[.]138 140.82.52[.]35 45.32.144[.]71 Several of our XDR customer |
| ipv4 | 216.128.146.38 | emote shell. It connects to a remote server ( 0xd8809226 or 216.128.146[.]38 in this specific case) and enters a loop to receive addit |
| ipv4 | 45.32.144.71 | .146[.]38 95.179.162[.]125 192.248.176[.]138 140.82.52[.]35 45.32.144[.]71 Several of our XDR customers experienced exploit attempts |
| ipv4 | 45.76.246.112 | of the threat actors creating SSH tunnels to the IP address 45.76.246[.]112 . Figure 7. PowerShell activity post-exploitation showing |
| ipv4 | 95.179.162.125 | control (C2) servers for these backdoors: 216.128.146[.]38 95.179.162[.]125 192.248.176[.]138 140.82.52[.]35 45.32.144[.]71 Several o |
From the original article
9 min read at unit42.paloaltonetworks.com
On Dec. 20, 2022, CrowdStrike published a blog discussing a new exploit method for Microsoft Exchange Server, which they named OWASSRF, referring to server-side request forgery in relation to Outlook on the web. (Outlook on the web is known as both Outlook Web Access and Outlook Web Application.)
By Lior Rochberger, Robert Falcone · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.