Personal Storage Table Files Accessed in Rackspace Attack
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-41080 | Microsoft Exchange Server Privilege Escalation Exploited in Ransomware Campaigns CVE-2022-41080 is an elevation-of-privilege flaw in Microsoft Exchange Server that stems from improper handling of requests to the server's Autodiscover component, allowing an attacker with any valid authenticated mailbox account to escalate privileges on the server. It is triggered by sending crafted authenticated HTTP requests to the Autodiscover endpoint, and it lets attackers bypass the URL-rewrite mitigations defenders had deployed against the earlier ProxyNotShell SSRF. When chained with the related PowerShell remote-code-execution bug CVE-2022-41082, privilege escalation becomes full remote code execution on the Exchange server. Any organization running on-premises Exchange Server with the Autodiscover component reachable — especially internet-exposed OWA/Autodiscover endpoints — is affected. The flaw is actively exploited: it was added to CISA's KEV catalog on 2023-01-10, is known to be used by ransomware operators, and has been tied to the Play ransomware gang, including the attack that took Rackspace's hosted Exchange environment offline. Do: Apply Microsoft Exchange Server security updates per vendor instructions (this CVE was fixed in Microsoft's November 2022 Exchange security updates — verify your servers are fully patched through the January 2023 rollups and that no Exchange builds predate the fix). Until patched, apply and verify the Autodiscover URL-rewrite/allow-list mitigation, knowing this flaw is a known bypass vector, and restrict Autodiscover/OWA exposure where feasible. Hunt for compromise in IIS logs for unusual requests to /autodiscover/autodiscover.json followed by PowerShell (CVE-2022-41082) activity, and treat any suspicious authenticated sessions as potential ransomware precursor activity. | 8.8 | 77% | KEV ransomware |
| large≈10,000–100,000 internet-exposed on-premises Exchange servers | |
| CVE-2022-41082 | Authenticated RCE in Microsoft Exchange Server (ProxyNotShell) CVE-2022-41082, dubbed "ProxyNotShell," is an authenticated remote code execution vulnerability in Microsoft Exchange Server; the associated CWE-502 indicates deserialization of untrusted data. It is exploited in a chain with CVE-2022-41040, a server-side request forgery in Exchange that lets an unauthenticated attacker reach the vulnerable endpoint via crafted web requests and trigger the remote code execution. Successful exploitation gives an attacker the ability to run code on the Exchange server, and CISA notes known ransomware use. Any organization running an on-premises Microsoft Exchange Server deployment is potentially affected, with the specific version ranges per Microsoft's advisory. The flaw is actively exploited in the wild: it was added to CISA KEV on 2022-09-30 with ransomware use known, and EPSS assigns a 100% probability of exploitation within 30 days, even though no public proof-of-concept is known. Do: Apply Microsoft's Exchange security updates immediately per vendor instructions, as required by CISA's KEV listing (added 2022-09-30). If patching is delayed, apply Microsoft's interim mitigations that restrict access to the Autodiscover endpoint used in the CVE-2022-41040 SSRF chain, and review web and PowerShell logs for signs of compromise given the known ransomware use. | 8.0 | 100% | KEV ransomware PoC |
| massorder of 10^5 |
Full article337 words · extracted from infosecurity-magazine.com · click to collapse
Rackspace has released more details of a ransomware attack in December that caused disruption for its Hosted Exchange customers, claiming that threat actors accessed files that may have contained emails, contacts and other details.
The firm was struck by the Play variant at the start of the month, forcing it to temporarily suspend its Hosted Exchange environment.
In an update yesterday, the hosting giant said that of 30,000 customers using the environment at the time of the attack, 27 had their Personal Storage Table (PST) data accessed.
A PST is a file used by Microsoft programs to store data including emails, calendar events and contacts.
However, Rackspace also sought to reassure these impacted customers with information from its IT forensics partner CrowdStrike.
“We have already communicated our findings to these customers proactively, and importantly, according to CrowdStrike, there is no evidence that the threat actor actually viewed, obtained, misused or disseminated emails or data in the PSTs for any of the 27 Hosted Exchange customers in any way,” it said.
“Customers who were not contacted directly by the Rackspace team can be assured that their PST data was not accessed by the threat actor.”
The firm also revealed that the initial access vector for the Play affiliate that compromised its environment was zero-day bug CVE-2022-41080. Patched by Microsoft in November, it’s an elevation of privilege vulnerability in Exchange Server.
According to CrowdStrike, the bug was exploited alongside one of the ProxyNotShell vulnerabilities (CVE-2022-41082) to achieve remote code execution through Outlook Web Access (OWA).
“The new exploit method bypasses URL rewrite mitigations for the Autodiscover endpoint provided by Microsoft in response to ProxyNotShell,” it explained.
Citing the research, Rackspace argued that previous reports suggesting that ProxyNotShell itself was the “root cause” of the incident were therefore inaccurate.
“Microsoft disclosed CVE-2022-41080 as a privilege escalation vulnerability and did not include notes for [it] being part of a remote code execution chain that was exploitable,” it said.
Editorial credit icon image: T. Schneider / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/personal-storage-table-accessed/