Grey Noise | Microsoft Exchange Proxy NotShell 0-Day Vulnerability
Summary: GreyNoise is investigating claims of multiple zero-day vulnerabilities in Microsoft Exchange Server, nicknamed ProxyNotShell, tracked as CVE-2022-41040 and CVE-2022-41082 and also by ZDI as ZDI-CAN-18333 and ZDI-CAN-18802. Microsoft said CVE-2022-41040 could let an authenticated attacker trigger CVE-2022-41082 remotely, and GreyNoise notes there is currently no patch available.
What's compelling: GreyNoise has not observed any new backend paths in use since 2021-08-27 and found no OWA-related traffic from the four IOC IPs in the past year, but with no patch available, the only defenses cited are Microsoft's mitigation guidance and a firewall blocklist for the 'Exchange ProxyNotShell Vuln Check' tag.