The most common exploit paths enterprises leave open for attackers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-26855 | Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon) CVE-2021-26855 is a server-side request forgery flaw (CWE-918) in Microsoft Exchange Server that allows an unauthenticated remote attacker to send specially crafted HTTP requests and have the Exchange server process them as itself, disclosing sensitive session information. When chained with sibling Exchange flaws (the 'ProxyLogon' chain), it yields authentication bypass and arbitrary file write, escalating to full remote code execution with SYSTEM-level privileges on the on-premises Exchange server. Any organization running an affected on-premises Exchange server reachable over HTTP/HTTPS (typically outbound webmail) is exposed; Exchange Online was not affected. Exploitation is confirmed in the wild at large scale: the flaw was mass-exploited beginning in early 2021 (notably by the HAFNIUM group), is on the CISA KEV with documented ransomware use, and has a maximum EPSS score of 100% (100th percentile), despite no public PoC listing. Do: Apply the vendor's March 2021 Exchange security updates (or later cumulative updates) immediately, per the CISA required action; until patched, limit Exchange (ECP/OWA) exposure to the internet via firewall/VPN rules. Hunt for compromise: review IIS logs for unrecognized authenticated activity against FrontEnd HttpProxy endpoints, and check for malicious files or webshells under inetpub\wwwroot\aspnet_client, given the known ransomware use. | 9.1 | 100% | KEV ransomware PoC ×4 |
| masshundreds of thousands of on-premises deployments; tens of thousands of internet-exposed Exchange servers | |
| CVE-2021-34473 +1 in the same advisory: …31206 | SSRF (CWE-918) in Microsoft Exchange Server Enabling RCE (ProxyShell) Microsoft Exchange Server contains a server-side request forgery (SSRF, CWE-918) in the Autodiscover service that unauthenticated remote attackers can reach over HTTP. This flaw is the first stage of the widely documented 'ProxyShell' chain, in which the SSRF is combined with privilege escalation and an arbitrary file write in the Exchange PowerShell backend to achieve unauthenticated remote code execution on the server. An attacker who successfully exploits it gains the ability to run code on the Exchange server, and ransomware operators (e.g., Cuba ransomware) leveraged this chain to deploy payloads. Organizations running on-premises Microsoft Exchange Server (2013, 2016, and 2019 per the vendor's advisories) are affected; hosted Exchange Online is a separately managed cloud service. Exploitation is confirmed in the wild: CISA added the flaw to the KEV catalog on 2021-11-03 with known ransomware use, and EPSS assigns it a 100% probability of exploitation within 30 days (100th percentile). Do: Apply Microsoft's July 2021 (or later) Exchange Server security updates, which include the ProxyShell fixes, to all on-premises servers. If patching is delayed, restrict internet access to the Autodiscover/EWS frontend endpoints and consider the URL Rewrite mitigation Microsoft published for ProxyShell. Given the KEV listing and known ransomware use, treat internet-facing, unpatched Exchange servers as potentially compromised and hunt for webshells, unusual Exchange processes, and suspicious account or mailbox activity. | 9.1 group max | 100% | KEV ransomware PoC |
| masshundreds of thousands of on-prem Exchange servers; public internet scans at the time of disclosure showed roughly 400,000+ internet-exposed Exchange instances,… | |
| CVE-2021-42321 | Authenticated RCE via Insecure Deserialization in Microsoft Exchange Server CVE-2021-42321 is an insecure deserialization remote code execution flaw in on-premises Microsoft Exchange Server, tied to insufficient validation by Exchange's ChainedSerializationBinder. Per the CVSS vector, it is triggered over the network by an authenticated user with low privileges and no user interaction, by submitting crafted serialized data that Exchange fails to safely deserialize. A successful attacker gains arbitrary code execution on the Exchange server with high impact to confidentiality, integrity, and availability, giving a foothold in the mail environment. Organizations running affected on-premises Exchange deployments are in scope. The flaw was actively exploited before patches shipped in November 2021, has public PoC exploits, was added to CISA's KEV on 2021-11-17 with known ransomware use, and carries an EPSS of 91.7% (99.9+ percentile). Do: Apply the November 2021 Microsoft Exchange Server security updates per vendor instructions to affected on-premises Exchange 2016/2019 deployments. Given confirmed in-the-wild exploitation and known ransomware use, check Exchange servers for signs of compromise, verify backups, and review accounts holding privileged Exchange roles, since exploitation requires authenticated access — enforce MFA and audit impersonation/admin role assignments while patching. | 8.8 | 92% | KEV ransomware PoC ×2 |
| masshundreds of thousands of internet-facing on-premises Exchange servers (on the order of 10^5 endpoints, supporting millions of mailbox users) |
Full article436 words · extracted from helpnetsecurity.com · click to collapse
Exposed version control repositories, leaked secrets in public code repositories, a subdomain vulnerable to takover, exposed Amazon S3 buckets, and Microsoft Exchange Server servers vulnerable to CVE-2021-42321 exploitation are the most common exploit paths medium to large enterprises left open for attackers in Q1 2022, according to Mandiant.
Opening doors for attackers
The firm has based the list on the most common issues discovered by continuously scanning the external attack surface of its customers from January 1, 2022 to March 31, 2022.
Other, less often encountered potential issues include exposed services and ports, msconfigurations, and specific vulnerabilities (e.g., in SAP, Log4j, etc.).
Those exposures happen mainly do to a lack of timely patching and a perpetual configuration drift in internet-facing assets. Misconfigurations and poor policy implementation are also a prominent reason behind exposed data repositories.
Exposed version control repositories can give attackers access to application source code, configuration files, sensitive data or confidential information; exposed S3 buckets usually contain sensitive company data; secrets such as passwords/authentication credentials, cryptographic keys and API tokens that may inadvertently be added to public code repositories such as GitHub or GitLab or Google Cloud Build could be found by attackers and used to publish malicious code.
“Configuring subdomains to point to a third party service is common practice for almost every organization. However, abandoned subdomains present a subtle but important risk vector,” the company notes.
“Abandoned subdomains pointing to a provider that allows attacker-supplied configuration and code can be used to compromise session credentials or in phishing campaigns.”
Microsoft Exchange Server Vulnerabilities
There is a reason why vulnerabilities in Microsoft Exchange Server always receive attention from attackers and the security community: Exchange Server is one of the most widely used mail solutions, especially by enterprises and governmental organizations, and compromising it allows attackers to access company/government email accounts, send out malicious spam that is more likely to bypass security checks, etc.
Mandiant has singled out several actively exploited vulnerabilities that are still present on many exposed Exchange Server instances: CVE-2021-42321, CVE-2021-31206, CVE-2021-26855 (aka ProxyLogon), and CVE-2021-34473 (aka one of the ProxyShell flaws).
Looking at the external attack surface like attackers do
Enterprises should constantly monitor their ever-changing external attack surface and act quickly when they detect exploitable holes and exploit paths This means not only closing them, but also checking whether attackers might have taken advantage of them during the window of opportunity they provided.
“Establishing a full view of the attack surface allows for cyber threat profile creation, prioritizations of updates and config changes, context for penetration testing, and incident response and remediation,” the company concluded.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2022/06/09/exploit-paths-enterprises/