Grey Noise| Trio Of Tags For Identifying Microsoft Message Queue Scanners And Exploiters Live Now - Queue Jumper (CVE-2023-21554)

Summary: GreyNoise published three tags for Microsoft Message Queuing (MSMQ) activity tied to QueueJumper (CVE-2023-21554), a critical unauthenticated remote code execution flaw patched in April 2023 Patch Tuesday, alongside two unauthenticated remote DoS vulnerabilities found by Check Point Research. GreyNoise reported no active RCE scanning attempts in its data for the prior 90 days, while its two MSMQ scanning tags together showed just over 500 unique IPs, all from sources it qualified as benign, including Censys and Shadowserver.
What you should know: Check Point researchers counted over 360,000 IPs with port 1801/tcp open running MSMQ, a legacy service that can be enabled without an administrator's knowledge by software such as Microsoft Exchange Server, and exploiting it could let attackers take over servers.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2023-21554
Related: Microsoft Patch Tuesday for April 2023 — Snort rules and prominent vulnerabilities Cyber Risks ·
KEV'd: CVE-2021-45046, CVE-2023-21839, and CVE-2023-1389 | Grey Noise Blog Cyber Risks ·
Grey Noise Round Up: Product Updates - April 2023 Cyber Risks ·