Microsoft Issues January 2023 Patch Tuesday Updates, Warns of Zero

Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability

CVE-2022-41080 is an elevation-of-privilege flaw in Microsoft Exchange Server that stems from improper handling of requests to the server's Autodiscover component, allowing an attacker with any valid authenticated mailbox account to escalate privileges on the server. It is triggered by sending crafted authenticated HTTP requests to the Autodiscover endpoint, and it lets attackers bypass the URL-rewrite mitigations defenders had deployed against the earlier ProxyNotShell SSRF. When chained with the related PowerShell remote-code-execution bug CVE-2022-41082, privilege escalation becomes full remote code execution on the Exchange server. Any organization running on-premises Exchange Server with the Autodiscover component reachable — especially internet-exposed OWA/Autodiscover endpoints — is affected. The flaw is actively exploited: it was added to CISA's KEV catalog on 2023-01-10, is known to be used by ransomware operators, and has been tied to the Play ransomware gang, including the attack that took Rackspace's hosted Exchange environment offline.

Do: Apply Microsoft Exchange Server security updates per vendor instructions (this CVE was fixed in Microsoft's November 2022 Exchange security updates — verify your servers are fully patched through the January 2023 rollups and that no Exchange builds predate the fix). Until patched, apply and verify the Autodiscover URL-rewrite/allow-list mitigation, knowing this flaw is a known bypass vector, and restrict Autodiscover/OWA exposure where feasible. Hunt for compromise in IIS logs for unusual requests to /autodiscover/autodiscover.json followed by PowerShell (CVE-2022-41082) activity, and treat any suspicious authenticated sessions as potential ransomware precursor activity.

CVE-2022-41082, dubbed "ProxyNotShell," is an authenticated remote code execution vulnerability in Microsoft Exchange Server; the associated CWE-502 indicates deserialization of untrusted data. It is exploited in a chain with CVE-2022-41040, a server-side request forgery in Exchange that lets an unauthenticated attacker reach the vulnerable endpoint via crafted web requests and trigger the remote code execution. Successful exploitation gives an attacker the ability to run code on the Exchange server, and CISA notes known ransomware use. Any organization running an on-premises Microsoft Exchange Server deployment is potentially affected, with the specific version ranges per Microsoft's advisory. The flaw is actively exploited in the wild: it was added to CISA KEV on 2022-09-30 with ransomware use known, and EPSS assigns a 100% probability of exploitation within 30 days, even though no public proof-of-concept is known.

Do: Apply Microsoft's Exchange security updates immediately per vendor instructions, as required by CISA's KEV listing (added 2022-09-30). If patching is delayed, apply Microsoft's interim mitigations that restrict access to the Autodiscover endpoint used in the CVE-2022-41040 SSRF chain, and review web and PowerShell logs for signs of compromise given the known ransomware use.

Windows SMB Witness Service Elevation of Privilege Vulnerability

CVE-2023-21674 is a use-after-free flaw (CWE-416) in the Windows Advanced Local Procedure Call (ALPC) facility, the kernel-level mechanism Windows uses for fast communication between processes and system services. An attacker who can already run code on a Windows machine can trigger the bug by sending crafted ALPC requests, corrupting memory in a privileged process. Successful exploitation allows a local, low-privileged attacker to elevate to SYSTEM/administrator privileges, typically to gain full control of the host or to complete an exploit chain after an initial compromise. Essentially all supported Windows client and server installations from Microsoft are affected; the source data does not list specific versions, and the fix shipped with Microsoft's January 2023 Patch Tuesday, which addressed a record 974 vulnerabilities including this and one other actively exploited Windows zero-day. CISA added the CVE to the Known Exploited Vulnerabilities catalog on 2023-01-10, confirming exploitation in the wild; no public proof-of-concept is known, ransomware use is undetermined, and EPSS estimates a 41.8% probability of exploitation in the next 30 days (99th percentile).

Do: Apply Microsoft's January 2023 (released 2023-01-10) or later Windows cumulative security updates to all Windows clients and servers, per CISA's required action to 'apply updates per vendor instructions.' Because this is a local privilege escalation, prioritize hosts where low-privileged users or untrusted code execute, such as endpoints, RDS/VDI servers, and multi-user systems, and verify installation via your update-management inventory. Treat this as actively exploited; with no public PoC or documented workaround, timely patching is the primary mitigation.

Microsoft SharePoint Server Security Feature Bypass Vulnerability

Windows Print Spooler Elevation of Privilege Vulnerability

Microsoft Exchange Server Elevation of Privilege Vulnerability