Microsoft vulnerabilities have grave implications for organizations of all sizes
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-26855 +1 in the same advisory: …27065 | Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon) CVE-2021-26855 is a server-side request forgery flaw (CWE-918) in Microsoft Exchange Server that allows an unauthenticated remote attacker to send specially crafted HTTP requests and have the Exchange server process them as itself, disclosing sensitive session information. When chained with sibling Exchange flaws (the 'ProxyLogon' chain), it yields authentication bypass and arbitrary file write, escalating to full remote code execution with SYSTEM-level privileges on the on-premises Exchange server. Any organization running an affected on-premises Exchange server reachable over HTTP/HTTPS (typically outbound webmail) is exposed; Exchange Online was not affected. Exploitation is confirmed in the wild at large scale: the flaw was mass-exploited beginning in early 2021 (notably by the HAFNIUM group), is on the CISA KEV with documented ransomware use, and has a maximum EPSS score of 100% (100th percentile), despite no public PoC listing. Do: Apply the vendor's March 2021 Exchange security updates (or later cumulative updates) immediately, per the CISA required action; until patched, limit Exchange (ECP/OWA) exposure to the internet via firewall/VPN rules. Hunt for compromise: review IIS logs for unrecognized authenticated activity against FrontEnd HttpProxy endpoints, and check for malicious files or webshells under inetpub\wwwroot\aspnet_client, given the known ransomware use. | 9.1 group max | 100% | KEV ransomware PoC ×4 |
| masshundreds of thousands of on-premises deployments; tens of thousands of internet-exposed Exchange servers | |
| CVE-2021-31207 +1 in the same advisory: …31195 | Security feature bypass in Microsoft Exchange Server (ProxyShell) enables webshell RCE CVE-2021-31207 is a security feature bypass in Microsoft Exchange Server, classified as an unrestricted file-write issue (CWE-434) that lets an attacker bypass intended restrictions and write files of their choosing to the server. It is the final bug in the ProxyShell chain: chained with the autodiscover SSRF and PowerShell backend elevation flaws, it allows an unauthenticated attacker to reach the Exchange PowerShell API, write arbitrary files such as an ASPX webshell, and execute code with SYSTEM privileges. A successful attacker gains full control of the on-premises Exchange server, including mailbox access, stolen credentials, and a foothold for lateral movement; the bug has been used to deploy ransomware and keyloggers. On-premises deployments of Microsoft Exchange Server (2013, 2016, and 2019 per vendor advisories) are affected, while Exchange Online/cloud mailboxes are not. Exploitation is essentially certain and ongoing: the flaw is in CISA's KEV (added 2021-11-03) with known ransomware use, public ProxyShell PoC/exploit code is available, and EPSS puts the 30-day exploitation probability at 99.8%. Do: Apply Microsoft's July 2021 security updates for Exchange Server 2013, 2016, and 2019 (or any later security/cumulative update) per vendor instructions, and restrict untrusted access to Exchange's autodiscover and PowerShell endpoints. Hunt for ASPX webshells under the Exchange FrontEnd directories and review IIS logs for autodiscover.json requests chaining PowerShell, since many servers were compromised before patching. Given known ransomware use and KEV listing, treat any server that was unpatched or internet-exposed during the exploitation window as potentially compromised. | 6.6 group max | 100% | KEV ransomware PoC |
| massHundreds of thousands of on-premises Exchange servers (public scans around the July 2021 ProxyShell disclosure showed roughly 400,000-600,000 internet-exposed… | |
| CVE-2021-34473 | SSRF (CWE-918) in Microsoft Exchange Server Enabling RCE (ProxyShell) Microsoft Exchange Server contains a server-side request forgery (SSRF, CWE-918) in the Autodiscover service that unauthenticated remote attackers can reach over HTTP. This flaw is the first stage of the widely documented 'ProxyShell' chain, in which the SSRF is combined with privilege escalation and an arbitrary file write in the Exchange PowerShell backend to achieve unauthenticated remote code execution on the server. An attacker who successfully exploits it gains the ability to run code on the Exchange server, and ransomware operators (e.g., Cuba ransomware) leveraged this chain to deploy payloads. Organizations running on-premises Microsoft Exchange Server (2013, 2016, and 2019 per the vendor's advisories) are affected; hosted Exchange Online is a separately managed cloud service. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile). Do: Apply Microsoft's July 2021 (or later) Exchange Server security updates, which include the ProxyShell fixes, to all on-premises servers. If patching is delayed, restrict internet access to the Autodiscover/EWS frontend endpoints and consider the URL Rewrite mitigation Microsoft published for ProxyShell. Given the KEV listing and known ransomware use, treat internet-facing, unpatched Exchange servers as potentially compromised and hunt for webshells, unusual Exchange processes, and suspicious account or mailbox activity. | 9.1 group max | 100% | KEV ransomware PoC |
| masshundreds of thousands of on-prem Exchange servers; public internet scans at the time of disclosure showed roughly 400,000+ internet-exposed Exchange instances,… | |
| CVE-2021-34527 | PrintNightmare: Remote Code Execution in Microsoft Windows Print Spooler CVE-2021-34527, widely known as 'PrintNightmare', is a remote code execution flaw in the Microsoft Windows Print Spooler service, which improperly performs privileged file operations such as loading printer driver DLLs. An attacker with low-level access who can reach a machine's spooler, for example a domain user able to add a printer connection via Point and Print, can induce the SYSTEM-privileged service to load an attacker-controlled DLL with no user interaction required (CVSS:3.1 vector AV:N/AC:L/PR:L/UI:N). Successful exploitation yields arbitrary code execution as SYSTEM, letting the attacker install programs, view, change or delete data, and create new accounts with full user rights, effectively achieving complete host compromise. The flaw affects all supported Windows client and server releases in the CISA data, Windows 10 from 1507 through 22H2, Windows 11, Windows RT 8.1, and Windows Server 2008, 2012 and 2016, wherever the Print Spooler service is running. Exploitation is confirmed in the wild: the bug was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 with known ransomware use, the FBI and CISA have warned of Russian actors exploiting it, and EPSS places the 30-day exploitation probability at 99.8%. Do: Install the July 2021 security updates immediately, released July 6, 2021 with additional updates on July 7 for Windows Server 2012, Windows Server 2016 and Windows 10 version 1607, and review KB5005010 for restricting installation of new printer drivers after applying the July 6 updates. Where patching is delayed, disable the Print Spooler service on hosts that do not need printing or restrict Point and Print, and verify that NoWarningNoElevationOnInstall and UpdatePromptSettings under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint are set to 0 or not defined (these keys do not exist by default, which is the secure state; NoWarningNoElevationOnInstall = 1 makes the system vulnerable by design). Prioritize domain controllers and servers with exposed spoolers, and hunt… | 8.8 | 100% | KEV ransomware PoC ×3 |
| masshundreds of millions of Windows systems (order of magnitude 10^8) | |
| CVE-2021-36934 | Local Privilege Escalation (SeriousSAM/HiveNightmare) in Microsoft Windows 10 CVE-2021-36934 is an elevation of privilege vulnerability in Windows caused by overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. A local attacker who already has the ability to execute low-privileged code on a victim system can leverage the misconfigured ACLs to gain arbitrary code execution with SYSTEM privileges, then install programs, view, change or delete data, or create new accounts with full user rights. Affected products per the CPE data are Windows 10 versions 1809, 1909, 2004, 20H2 and 21H1, with related coverage noting the bug impacts all Windows 10 versions released in the past 2.5 years and also references Windows 11. CISA added the flaw to its Known Exploited Vulnerabilities Catalog on 2022-02-10, confirming in-the-wild exploitation, and EPSS assigns a 67.3% probability of exploitation within 30 days (99th percentile). Mitigation is two-step: installing the security update alone is not sufficient — administrators must also manually delete all shadow copies of system files, including the SAM database, per KB5005357. Do: Apply Microsoft's security update per vendor instructions, then follow KB5005357 to manually delete all shadow copies of system files (including the SAM database), because the update alone does not fully mitigate the vulnerability. Restrict or verify ACLs on the System32 config directory and shadow-copy access if shadow-copy deletion cannot be done immediately, and prioritize patching given the flaw's listing in CISA's Known Exploited Vulnerabilities Catalog. | 7.8 | 67% | KEV |
| masshundreds of millions of Windows 10 devices (every supported feature update from mid-2018 through mid-2021 is in scope) | |
| CVE-2021-36942 | Unauthenticated LSA Spoofing (PetitPotam NTLM Relay) in Microsoft Windows CVE-2021-36942 is a spoofing flaw in the Windows Local Security Authority (LSA), widely known as "PetitPotam," that lets an unauthenticated network attacker trick a Windows host into authenticating with NTLM to a machine the attacker controls. It is triggered remotely with no privileges and no user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N) by sending crafted requests that coerce the target system to authenticate. By relaying that coerced authentication to other services, an attacker can impersonate the machine — most critically a domain controller — and escalate toward domain-administrator access, producing a high confidentiality impact. All listed Windows Server releases are affected, with domain controllers and certificate-services servers as the highest-value targets. The flaw is actively exploited in the wild: it was added to CISA's KEV on 2021-11-03 with known ransomware use (LockFile and Babuk campaigns chained it with Exchange flaws), and Microsoft has released Windows updates to address it. Do: Apply Microsoft's Windows updates per vendor instructions, prioritizing domain controllers and servers running Active Directory Certificate Services. As interim hardening, require SMB signing and restrict NTLM authentication per Microsoft guidance, and review authentication logs for unexpected NTLM connections from domain controllers to certificate-services endpoints. | 7.5 | 66% | KEV ransomware PoC |
| massmillions of Windows Server deployments; hundreds of thousands of SMB-exposed hosts in public internet scans | |
| CVE-2021-40444 | Remote Code Execution via MSHTML Rendering Engine in Microsoft Windows/Office (CVE-2021-40444) CVE-2021-40444 is a remote code execution vulnerability in the Microsoft MSHTML browser rendering engine, which Microsoft Office documents can load on Windows systems. It is triggered when a user is convinced to open a specially crafted Office document containing a malicious ActiveX control hosted by the MSHTML engine (tracked as a path-traversal-class issue, CWE-22). A successful attacker gains the ability to run arbitrary code in the context of the logged-on user, with greater impact when that user has administrative rights. Any Windows system that can open Office documents is exposed, spanning Windows 7, 8.1, RT 8.1, Windows 10 (1507 through 21H1) and Windows Server 2004/2008. Exploitation is confirmed in the wild: Microsoft observed targeted attacks at disclosure, the flaw is in CISA's KEV with known ransomware use, and Microsoft released security updates on September 14, 2021. Do: Apply Microsoft's security updates released September 14, 2021 for your Windows version immediately; this is a CISA KEV item with known ransomware use, so patching is treated as mandatory. As interim protection, keep Microsoft Defender Antivirus/Defender for Endpoint signatures current (enterprise detection build 1.349.22.0 or newer, with alerts appearing as 'Suspicious Cpl File Execution') and avoid opening untrusted Office documents, since exploitation requires user interaction with a crafted file. | 8.8 | 97% | KEV ransomware PoC ×2 |
| masshundreds of millions of Windows PCs and servers (nearly all Windows desktop/laptop installs on affected versions at disclosure) |
Full article1,273 words · extracted from helpnetsecurity.com · click to collapse
Microsoft software products are a connective tissue of many organizations, from online documents (creating, sharing, storing), to email and calendaring, to the operating systems that enable business operations on the front and back ends, both in the cloud and on premises.
Over 1 million companies worldwide and over 731,000 companies in the U.S. use Office 365, and though Microsoft offers no hard stats, some sources suggest there are over 90,000 Microsoft partners facilitating services and products for clients. It’s no wonder, then, that vulnerabilities in Microsoft solutions are an attractive attack vector.
So far in 2021, the 12 most notable critical Microsoft vulnerabilities fall within five major threat categories:
- Exchange vulnerabilities
- Print Spooler vulnerabilities
- Sensitive Windows Registry database files vulnerabilities
- Encrypting File System Remote Protocol (MS-EFSRPC) and Active Directory Certificate Services (AD CS) vulnerabilities, and
- ActiveX vulnerabilities.
Let’s break them down.
Exchange vulnerabilities
Microsoft Exchange comprises the back end of integrated messaging, calendaring, tasks, and email. Exchange Server is among the most widely used and well-known mail solutions for governments and enterprises across the globe. Managing Exchange Server in-house is a complex task, and misconfigured Exchange servers are especially troubling because threat actors actively scan and exploit vulnerable Exchange servers that aren’t configured correctly or have the most current security patches and updates.
Recent Microsoft Exchange Server vulnerabilities include ProxyLogon, ProxyOracle and ProxyShell.
ProxyLogon (CVE-2021-26855 and CVE-2021-27065) targets on-premise Exchange servers. This bug exploits the Exchange Proxy Architecture and its Logon mechanism, allowing the threat actor to bypass authentication on the Exchange Server, impersonate an admin and gain code execution abilities.
ProxyOracle (CVE-2021-31196 and CVE-2021-31195) is a bit trickier than ProxyLogon in that threat actors must trick users into clicking on a malicious link to steal the user’s password. The form-based authentication used to manage user logins for Outlook Web Access saves credentials and passwords in a user’s browser cookies, which are encrypted. To work around those measures, threat actors use a padding oracle attack to help decrypt the user’s cookies and get the plaintext passwords.
ProxyShell (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207) is another on-prem Exchange Server vulnerability on unpatched servers with Internet access. ProxyShell works by abusing the Client Access Service URL normalization that’s triggered by logon requests. When logon requests are initiated, Exchange normalizes the request URL and nixes the portion containing the mail address before routing the logon request to the backend. With ProxyShell, threat actors can remove part of the URL during the normalization process, grant access to an arbitrary backend URL, and execute commands on the Exchange Server by using an exposed 443 port with Exchange PowerShell Remoting. In simple terms, this allows threat actors to act as an Exchange Admin and execute PowerShell commands remotely.
Print Spooler vulnerabilities
Printers in general and Print Spooler in particular have been targeted for exploitation by threat actors for many years. For example, the infamous 2010 Stuxnet worm – the one used against Iranian nuclear facilities – used a Print Spooler vulnerability.
PrintNightmare (CVE-2021-34527) is a vulnerability that lets attackers with a low-privilege domain user account take control of a server running on the Print Spooler service and add dynamic link library (DLL) files as printer drivers, which they later execute via SYSTEM. Once the threat actor exploits this vulnerability, they can install programs, manipulate data, and create new users with full permissions.
Sensitive Windows Registry database files vulnerabilities
Windows Registry stores information about configurations, parameters and preferences for Windows OS and applications. It contains a set of files called hives, such as SYSTEM and SECURITY hives, and the Windows Security Accounts Manager (SAM) database. A threat actor who abuses the sensitive Windows Registry database files vulnerability and successfully authenticates to a machine can run arbitrary code with SYSTEM privileges.
HiveNightmare aka SeriousSAM (CVE-2021-36934) is one such vulnerability. Using a low-privileged account, a threat actor can use the pass the hash method to authenticate a remote server with hashed credentials they got from the database. (You read that correctly – default Windows 10 and 11 configurations grant all non-admin users read rights on key registry hives; it’s a known error.) This allows them to retrieve all Registry hives in Windows 10 and 11. That includes SAM data, which the attacker can use to execute code as SYSTEM. Once their machine is authenticated, the attacker gains full control, can run commands, drop extra payloads, spread over the network, and create users with full permissions.
MS-EFSRPC & AD CS vulnerabilities
Microsoft Encrypting File System Remote Protocol (MS-EFSRPC) takes care of your data that is encrypted, remotely stored and accessed over a network. It performs maintenance and management operations. Active Directory Certificate Services (AD CS) is a server role that lets users create a public key infrastructure (PKI) and provides public key cryptography, digital certificates and signature capabilities and other security functions.
PetitPotam (CVE-2021-36942) is an example of a new technology LAN manager (NTLM) relay attack. PetitPotam is a type of relay attack in which threat actors that have already accessed the victim’s machine gain the ability to take over an Active Directory with AC DS in use. In this type of attack, rather than taking advantage of one specific vulnerability, threat actors exploit the authentication method in the MS-EFSRPC to yield an authentication certificate, which leads to domain compromise and the ability to elevate privileges within the domain.
ActiveX vulnerabilities
ActiveX controls are program parts used to create and execute applications that work over a network. Applications rely on ActiveX to share functionality and data over web browsers, so this vulnerability can be exploited through online Microsoft Office documents.
MSHTML (CVE-2021-40444) is a highly sophisticated remote code execution vulnerability that lets an attacker run arbitrary code on a victim’s machine through ActiveX control that is typically sent to the victim through spear-phishing. The threat actor lures the user to open the malicious document, and once the file is opened and the code is executed, the threat actor performs malicious activities such as running commands remotely, dropping extra payloads and gaining persistence.
Feeling vulnerable?
According to IBM’s Cost of a Data Breach Report 2021, the average cost of a data breach increased by the largest year-over-year margin in seven years, from $3.86M in 2020 to $4.24M in 2021. The average time elapsed before a breach was detected in 2021 was 212 days with an additional 75 days to contain it!
The attack types we’ve explored in this article lead to compromised domains and the ability for criminals to create their own accounts with full admin credentials. And according to the report, compromised credentials were the most common attack vector, responsible for 20% of breaches and costing an average of $4.37M per breach.
Each of these Microsoft vulnerabilities has grave implications for organizations of all sizes. For example, PrintNightmare is critical because the Print Spooler service runs by default on all Windows servers and clients. It’s alarming that this iteration evolved from an earlier vulnerability that was patched but edited to reduce the patch to only half effective. And HiveNightmare (aka SeriousSAM) works because of a vulnerability in a company’s Windows OS. It also doesn’t require unencrypted credentials. These attack types justify the need to keep all systems updated in addition to staying up to date on Microsoft vulnerabilities.
Cybersecurity leaders must ensure they are deploying detection rules designed to detect and prevent exploitation attempts of these vulnerabilities and create additional detection rules to place more focus on the risk. Push all patches available for Microsoft products and keep an eye out for not only newly discovered vulnerabilities but also evolutions of known ones.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/12/10/microsoft-vulnerabilities-implications/