Microsoft Fixes Exchange Server Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-31166 | Use-After-Free RCE in Microsoft Windows HTTP Protocol Stack (http.sys) CVE-2021-31166 is a use-after-free vulnerability (CWE-416) in the Microsoft HTTP Protocol Stack, the kernel-mode HTTP service (http.sys) used by Windows components including IIS and WinRM. A remote, unauthenticated attacker can trigger the flaw by sending specially crafted network packets to a service that listens through http.sys, and reporting indicates WinRM servers are also impacted. Successful exploitation yields remote code execution in the kernel context, with full compromise potential (high confidentiality, integrity and availability impact), consistent with the wormable classification in vendor-adjacent reporting. Affected platforms are Windows 10 versions 2004 and 20H2 and Windows Server versions 2004 and 20H2, which were the current shipping Windows versions at the May 2021 Patch Tuesday release where the fix appeared. The issue is tracked in CISA's Known Exploited Vulnerabilities catalog (added 2022-04-06) and carries a near-certain EPSS exploitation probability (~99.8%), indicating active exploitation in the wild. Do: Apply the May 2021 Patch Tuesday security updates for Windows 10 and Windows Server versions 2004 and 20H2, prioritizing internet-facing systems running IIS, WinRM, or other http.sys-based listeners. As an interim mitigation, restrict inbound access to HTTP and WinRM endpoints at the firewall. Confirm remediation by verifying the OS build includes the May 2021 cumulative update, and check the CISA KEV catalog action (apply updates per vendor instructions). | 9.8 | 100% | KEV |
| masswell over 1,000,000 vulnerable systems (tens of millions of Windows 10 2004/20H2 installs, with likely hundreds of thousands of internet-exposed servers via… | |
| CVE-2021-31181 | Microsoft SharePoint Remote Code Execution Vulnerability Microsoft SharePoint Remote Code Execution Vulnerability NVD description · AI analysis pending | 8.8 | 30% | PoC |
| — | |
| CVE-2021-31200 | Common Utilities Remote Code Execution Vulnerability Common Utilities Remote Code Execution Vulnerability NVD description · AI analysis pending | 7.2 | 2% |
| — | ||
| CVE-2021-31204 | .NET and Visual Studio Elevation of Privilege Vulnerability .NET and Visual Studio Elevation of Privilege Vulnerability NVD description · AI analysis pending | 7.3 | 1% |
| — | ||
| CVE-2021-31207 | Security feature bypass in Microsoft Exchange Server (ProxyShell) enables webshell RCE CVE-2021-31207 is a security feature bypass in Microsoft Exchange Server, classified as an unrestricted file-write issue (CWE-434) that lets an attacker bypass intended restrictions and write files of their choosing to the server. It is the final bug in the ProxyShell chain: chained with the autodiscover SSRF and PowerShell backend elevation flaws, it allows an unauthenticated attacker to reach the Exchange PowerShell API, write arbitrary files such as an ASPX webshell, and execute code with SYSTEM privileges. A successful attacker gains full control of the on-premises Exchange server, including mailbox access, stolen credentials, and a foothold for lateral movement; the bug has been used to deploy ransomware and keyloggers. On-premises deployments of Microsoft Exchange Server (2013, 2016, and 2019 per vendor advisories) are affected, while Exchange Online/cloud mailboxes are not. Exploitation is essentially certain and ongoing: the flaw is in CISA's KEV (added 2021-11-03) with known ransomware use, public ProxyShell PoC/exploit code is available, and EPSS puts the 30-day exploitation probability at 99.8%. Do: Apply Microsoft's July 2021 security updates for Exchange Server 2013, 2016, and 2019 (or any later security/cumulative update) per vendor instructions, and restrict untrusted access to Exchange's autodiscover and PowerShell endpoints. Hunt for ASPX webshells under the Exchange FrontEnd directories and review IIS logs for autodiscover.json requests chaining PowerShell, since many servers were compromised before patching. Given known ransomware use and KEV listing, treat any server that was unpatched or internet-exposed during the exploitation window as potentially compromised. | 6.6 | 100% | KEV ransomware PoC |
| massHundreds of thousands of on-premises Exchange servers (public scans around the July 2021 ProxyShell disclosure showed roughly 400,000-600,000 internet-exposed… |
Full article285 words · extracted from infosecurity-magazine.com · click to collapse
Microsoft fixed 55 vulnerabilities yesterday including three zero-days not thought to have been exploited in the wild, one of which affected the under-fire Exchange Server.
This month’s Patch Tuesday is lighter than many have been in recent months, but there were four critical CVEs for admins to address, alongside the three publicly disclosed bugs.
Top of the priority list should be CVE-2021-31207, which was discovered as part of this year’s Pwn2Own competition, according to Ivanti senior director of product management, Chris Goettl.
“Microsoft Exchange admins have had a rough stretch in the past few months starting with the zero-day exploits targeted by Hafnium followed by the April Exchange update resolving four NSA discovered vulnerabilities,” he said.
“CVE-2021-31207 is only rated as moderate, but the security feature bypass exploit was showcased prominently in the Pwn2Own contest and at some point details of the exploit will be published. At that point threat actors will be able to take advantage of the vulnerability if they have not already begun attempting to reverse engineer an exploit.”
The other two zero-days fixed by Microsoft this month are CVE-2021-31200, a remote code execution (RCE) vulnerability in Common Utilities, and CVE-2021-31204 which is an elevation of privilege flaw in .NET and Visual Studio.
“Both publicly disclosed vulnerabilities are rated as Important, but the disclosure puts them at a higher risk of being exploited,” warned Goettl.
Of the critical CVEs, Qualys research and engineering VP, Anand Paturi, singled out SharePoint RCE bug CVE-2021-31181, and CVE-2021-31166, an HTTP protocol stack RCE vulnerability in Windows.
Also this month, Adobe resolved 42 CVEs, 16 of which are rated critical and one of which is a zero-day being actively exploited in the wild.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/microsoft-exchange-server-zeroday/