Threat Brief: CVE-2022-41040 and CVE-2022-41082: Microsoft Exchange Server (Proxy NotShell)
Summary: GTSC discovered two new Microsoft Exchange zero-days in early August, CVE-2022-41040 (a server-side request forgery rated critical) and CVE-2022-41082 (remote code execution rated important when Exchange PowerShell is reachable), and reported them through ZDI to Microsoft. The exploit requires only standard-user authentication, attackers gained PowerShell execution and installed China Chopper webshells for persistence, and Microsoft had not released a patch at the time, offering instead a URL Rewrite rule and disabling remote PowerShell for non-admins.
Bottom line: Microsoft's MSTIC attributed the chained exploitation in a small number of targeted attacks to a single activity group with medium confidence, and Unit 42 expects working exploits and proof-of-concept code to become available given how ProxyShell played out. The authentication bar is a standard user account, which the brief notes is not a high bar to overcome.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2021-31207CVE-2021-34473CVE-2021-34523CVE-2022-41040CVE-2022-41082
- Related