Microsoft: Two New 0-Day Flaws in Exchange Server
Summary: Microsoft is investigating two previously unknown Exchange Server vulnerabilities, CVE-2022-41040 (a Server-Side Request Forgery flaw) and CVE-2022-41082 (a remote code execution flaw reachable when PowerShell is accessible), affecting Exchange Server 2013, 2016, and 2019, and is expediting patches while urging on-premises customers to apply mitigations. GTSC, which first observed the attacks in early August, reported obfuscated webshells dropped on Exchange servers and tied the tooling to Antsword and a codepage 936 that it suspects points to a Chinese attack group.
Key Takeaway: The flaws require a valid Exchange username and password, but Volexity has tied an attacker IP in GTSC's writeup with high confidence to a China-based group it says has been phishing Exchange users for credentials - the same group it linked in February 2022 to mass exploitation of a Zimbra zero-day.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2022-41040CVE-2022-41082
- Related
- Patch Tuesday, November 2022 Election Edition Cyber Risks ·Threat Brief: OWASSRF Vulnerability Exploitation Cyber Risks ·