Defending Microsoft Exchange from encrypted attacks with Cisco Secure IPS
Summary: Cisco Talos published a guide for configuring SSL decryption on Cisco Secure IPS (NGIPS) to inspect and block encrypted ProxyLogon attacks against Microsoft Exchange. ProxyLogon (CVE-2021-26855) is a server-side request forgery flaw that lets an attacker bypass authentication with only a valid email address, after which CVE-2021-27065 is often used to write a JScript web shell that gives full control of the server.
Bottom line: The exploit arrives inside encrypted traffic, so without SSL decryption on an inline Firepower IPS device, the attack passes through uninspected; Talos states that defending against these vulnerabilities is critical and should be considered high priority.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-26855CVE-2021-27065
- Related
- Threat Assessment: Active Exploitation of Four Zero-Day Vulnerabilities in Microsoft Exchange Server Cyber Risks ·Microsoft Exchange Server Attack Timeline Cyber Risks ·