How an unpatched Microsoft Exchange 0-day likely caused one of the UK’s biggest hacks ever
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-41080 | Microsoft Exchange Server Privilege Escalation Exploited in Ransomware Campaigns CVE-2022-41080 is an elevation-of-privilege flaw in Microsoft Exchange Server that stems from improper handling of requests to the server's Autodiscover component, allowing an attacker with any valid authenticated mailbox account to escalate privileges on the server. It is triggered by sending crafted authenticated HTTP requests to the Autodiscover endpoint, and it lets attackers bypass the URL-rewrite mitigations defenders had deployed against the earlier ProxyNotShell SSRF. When chained with the related PowerShell remote-code-execution bug CVE-2022-41082, privilege escalation becomes full remote code execution on the Exchange server. Any organization running on-premises Exchange Server with the Autodiscover component reachable — especially internet-exposed OWA/Autodiscover endpoints — is affected. The flaw is actively exploited: it was added to CISA's KEV catalog on 2023-01-10, is known to be used by ransomware operators, and has been tied to the Play ransomware gang, including the attack that took Rackspace's hosted Exchange environment offline. Do: Apply Microsoft Exchange Server security updates per vendor instructions (this CVE was fixed in Microsoft's November 2022 Exchange security updates — verify your servers are fully patched through the January 2023 rollups and that no Exchange builds predate the fix). Until patched, apply and verify the Autodiscover URL-rewrite/allow-list mitigation, knowing this flaw is a known bypass vector, and restrict Autodiscover/OWA exposure where feasible. Hunt for compromise in IIS logs for unusual requests to /autodiscover/autodiscover.json followed by PowerShell (CVE-2022-41082) activity, and treat any suspicious authenticated sessions as potential ransomware precursor activity. | 8.8 | 77% | KEV ransomware |
| large≈10,000–100,000 internet-exposed on-premises Exchange servers | |
| CVE-2022-41082 | Authenticated RCE in Microsoft Exchange Server (ProxyNotShell) CVE-2022-41082, dubbed "ProxyNotShell," is an authenticated remote code execution vulnerability in Microsoft Exchange Server; the associated CWE-502 indicates deserialization of untrusted data. It is exploited in a chain with CVE-2022-41040, a server-side request forgery in Exchange that lets an unauthenticated attacker reach the vulnerable endpoint via crafted web requests and trigger the remote code execution. Successful exploitation gives an attacker the ability to run code on the Exchange server, and CISA notes known ransomware use. Any organization running an on-premises Microsoft Exchange Server deployment is potentially affected, with the specific version ranges per Microsoft's advisory. The flaw is actively exploited in the wild: it was added to CISA KEV on 2022-09-30 with ransomware use known, and EPSS assigns a 100% probability of exploitation within 30 days, even though no public proof-of-concept is known. Do: Apply Microsoft's Exchange security updates immediately per vendor instructions, as required by CISA's KEV listing (added 2022-09-30). If patching is delayed, apply Microsoft's interim mitigations that restrict access to the Autodiscover endpoint used in the CVE-2022-41040 SSRF chain, and review web and PowerShell logs for signs of compromise given the known ransomware use. | 8.0 | 100% | KEV ransomware PoC |
| massorder of 10^5 |
Full article362 words · extracted from arstechnica.com · click to collapse
“At the time Microsoft released temporary mitigations rather than a security patch—it took until November 2022 for a security update to appear to fully resolve the problem,” the researcher wrote. “This was a significant delay. In the meantime, the security mitigations Microsoft provided were repeatedly bypassed.” Later in the post, he added, “Microsoft needs to ship security patches for Microsoft Exchange Server faster. It needs some kind of emergency patch pipeline.”
Citing results returned by the Shodan search engine for Internet-connected devices, both Beaumont and Whittaker said that the Commission ran an Internet-exposed on-premises Exchange Server with Outlook Web App until late September 2020, when it suddenly stopped responding. The searches show that Commission staff had last updated the server software in August. As already noted, August was the same month active exploits of vulnerabilities began.
“To be clear, this means the Electoral Commission (or their IT supplier) did the right thing—they were applying security patches quickly during this time in 2022,” the researcher wrote.
Better known as ProxyNotShell, CVE-2022-41082 and CVE-2022-41080 affect on-premises Exchange servers. Microsoft said in early October that it was aware of only a single threat actor exploiting the vulnerabilities and that the actor had targeted fewer than 10 organizations. The threat actor is fluent in Simplified Chinese, suggesting it has a nexus to China.
In December, cloud host Rackspace disclosed a breach that it later said was caused by the exploitation of a zero-day “associated with” CVE-2022-41080. By that point, the patches Microsoft released had been available for four weeks. The latter post, which attributed the attacks to a ransomware syndicate tracked as Play, went on to criticize Microsoft’s initial disclosure of the vulnerability.
“Microsoft disclosed CVE-2022-41080 as a privilege escalation vulnerability and did not include notes for being part of a Remote Code Execution chain that was exploitable,” Rackspace officials wrote.
The hack of the Commission’s Exchange server is a potent reminder of the damage that can result when the software is abused. It also underscores the harm that can happen when vendors fail to provide updates in a timely manner or issue faulty security guidance. Microsoft representatives didn’t respond to an email seeking comment.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arstechnica.com/security/2023/08/how-an-unpatched-microsoft-exchange-0-day-likely-caused-one-of-the-uks-biggest-hacks-ever/