Threat Brief: OWASSRF Vulnerability Exploitation
Summary: On Dec. 20, 2022, CrowdStrike published a blog describing OWASSRF, an exploit method chaining CVE-2022-41080 and CVE-2022-41082 to achieve remote code execution via Outlook Web Access on Microsoft Exchange Server, bypassing the mitigations Microsoft had provided for ProxyNotShell. Unit 42 observed active exploitation in late November and early December 2022, with actors using a PowerShell-based backdoor tracked as SilverArrow, and reported eight organizations that had seen exploitation activity.
Bottom line: OWASSRF requires prior authentication, so Unit 42 saw isolated rather than mass exploitation - meaning the actors likely already held stolen credentials, and one unblocked Exchange Server was compromised on Nov. 28, 2022, with the actor creating an administrator account named Admon, tunneling RDP through PuTTY Link, and dumping LSASS memory to extract credentials.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-41040CVE-2022-41080CVE-2022-41082
- Related
- Patch Tuesday, November 2022 Election Edition Cyber Risks ·Microsoft: Two New 0-Day Flaws in Exchange Server Cyber Risks ·