Microsoft releases one-click Exchange On-Premises Mitigation Tool
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-26855 | Unauthenticated SSRF/RCE in Microsoft Exchange Server (ProxyLogon) CVE-2021-26855 is a server-side request forgery flaw (CWE-918) in Microsoft Exchange Server that allows an unauthenticated remote attacker to send specially crafted HTTP requests and have the Exchange server process them as itself, disclosing sensitive session information. When chained with sibling Exchange flaws (the 'ProxyLogon' chain), it yields authentication bypass and arbitrary file write, escalating to full remote code execution with SYSTEM-level privileges on the on-premises Exchange server. Any organization running an affected on-premises Exchange server reachable over HTTP/HTTPS (typically outbound webmail) is exposed; Exchange Online was not affected. Exploitation is confirmed in the wild at large scale: the flaw was mass-exploited beginning in early 2021 (notably by the HAFNIUM group), is on the CISA KEV with documented ransomware use, and has a maximum EPSS score of 100% (100th percentile), despite no public PoC listing. Do: Apply the vendor's March 2021 Exchange security updates (or later cumulative updates) immediately, per the CISA required action; until patched, limit Exchange (ECP/OWA) exposure to the internet via firewall/VPN rules. Hunt for compromise: review IIS logs for unrecognized authenticated activity against FrontEnd HttpProxy endpoints, and check for malicious files or webshells under inetpub\wwwroot\aspnet_client, given the known ransomware use. | 9.1 group max | 100% | KEV ransomware PoC ×4 |
| masshundreds of thousands of on-premises deployments; tens of thousands of internet-exposed Exchange servers |
Full article388 words · extracted from helpnetsecurity.com · click to collapse
Microsoft has released Exchange On-Premises Mitigation Tool (EOMT), which quickly performs the initial steps for mitigating the ProxyLogon flaw (CVE-2021-26855) on any Exchange server and attempts to remediate found compromises.
“This tool is not a replacement for the Exchange security update but is the fastest and easiest way to mitigate the highest risks to internet-connected, on-premises Exchange Servers prior to patching,” Microsoft explained.
About Microsoft Exchange On-Premises Mitigation Tool
EOMT is a PowerShell script that must be run as Administrator on on-premises Exchange servers, and it does the following:
- Mitigates against current known attacks using CVE-2021-26855 via a URL Rewrite configuration
- Downloads Microsoft Safety Scanner, a tool designed to find and remove malware from Windows computers, and uses it to scan the underlying Exchange Server for malicious artifacts and changes
- Attempt to reverse discovered changes make by known threats
“The Exchange On-premises Mitigation Tool is effective against the attacks we have seen so far, but is not guaranteed to mitigate all possible future attack techniques,” Microsoft made sure to note, and pointed out that Exchange servers should be fully updated as quickly as possible after using it.
EOMT mitigates only the ProxyLogon flaw (CVE-2021-26855) but not the other three vulnerabilities (CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065) exploited in the escalating attacks on Exchange servers.
The four vulnerabilities are being exploited as part of an attack chain, but it’s through CVE-2021-26855 that the attackers are able to make an untrusted connection to target Exchange servers.
“Other portions of the attack can be triggered if the attacker already has access or gets access through other means,” Microsoft explained, and this is why patching is the only way to mitigate the threat completely.
Microsoft recommends this script over the previously released ExchangeMitigations.ps1 script, as it tuned based on the latest threat intelligence. Also, the ExchangeMitigations.ps1 script does not scan for existing compromise or exploitation (though it mitigates all of the four vulnerabilities used in the attacks),
It must also be pointed out that EOMT runs the Microsoft Safety Scanner in a quick scan mode. “If you suspect any compromise, we highly recommend you run it in the FULL SCAN mode. FULL SCAN mode can take a long time but if you are not running Microsoft Defender AV as your default AV, FULL SCAN will be required to remediate threats,” Microsoft advised.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2021/03/16/microsoft-exchange-mitigation/