{"id":13195,"date":"2023-01-02T14:28:00","date_gmt":"2023-01-02T13:28:00","guid":{"rendered":"http:\/\/nfirjun2026.local\/proxynotshell-new-vulnerabilities-in-microsoft-exchange-server-cve-2022-41040-cve-2022-41082-update\/"},"modified":"2024-02-12T14:12:41","modified_gmt":"2024-02-12T13:12:41","slug":"proxynotshell-new-vulnerabilities-in-microsoft-exchange-server-cve-2022-41040-cve-2022-41082-update","status":"publish","type":"post","link":"https:\/\/www.cyber-security-online.nl\/en\/proxynotshell-new-vulnerabilities-in-microsoft-exchange-server-cve-2022-41040-cve-2022-41082-update\/","title":{"rendered":"ProxyNotShell: New vulnerabilities in Microsoft Exchange Server (CVE-2022-41040, CVE-2022-41082) (update)"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t
Update January 2, 2023<\/strong><\/h5>\n

Microsoft has released Nov. 8, 2022 security updates for Exchange Server 2013, 2016 and 2019. These protect against CVE-2022-41040 and CVE-2022-41082. NFIR at all times recommends installing patches as soon as they are available. These patches constitute the structural final measure and override the temporary mitigation measures. <\/strong><\/p>\n

See also the FAQ section in the Microsoft blog:
https:\/\/techcommunity.microsoft.com\/t5\/exchange-team-blog\/released-november-2022-exchange-server-security-updates\/ba-p\/3669045<\/a>
For environments still vulnerable to CVE-2022-41040 and CVE-2022-41082, new exploits are regularly published by security researchers. For example, see this Dec. 20, 2022 article from CrowdStrike:<\/p>\n

OWASSRF: CrowdStrike Identifies New Method for Bypassing ProxyNotShell Mitigations<\/a><\/p>\n

This means that the temporary measures published as a workaround in 2022 are no longer sufficient to close these CVE vulnerabilities. Keeping Exchange up to date with the latest patches from Microsoft is the motto. The recommendation is to have at least patch level November 2022 for Exchange Server to protect against CVE-2022-41040 and CVE-2022-41082.<\/p>\n

===<\/p>\n

A set of two new zero-day vulnerabilities for Microsoft Exchange Servers – ProxyNotShell, disclosed by GTSC on Sept. 29, 2022, is currently being actively exploited by hackers. No patch is available at the time of writing.<\/strong><\/p>\n

Microsoft published a “Customer Guidance” article in the Microsoft Security Response Center on the morning of Sept. 30, 2022, in which Microsoft confirms it is investigating two reported zero-day vulnerabilities. They are CVE-2022-41040, a Server-Side Request Forgery (SSRF) vulnerability and CVE-2022-41082, a Remote Code Execution (RCE) vulnerability if PowerShell is accessible to the attacker.<\/p>\n

Microsoft is aware of limited targeted attacks exploiting the vulnerabilities to get into victims’ systems. In these attacks, CVE-2022-41040 can enable an “authenticated” attacker (i.e., the attacker must already have a successful successful login to the affected environment) to then trigger CVE-2022-41082. It should be noted that authenticated access to the vulnerable Exchange Server is required to successfully exploit one of the two vulnerabilities. The vulnerability uses what is known as Autodiscover functionality. URLs using Autodiscover do not have Multi-Factor Authentication (MFA) protection.<\/p>\n

Microsoft is currently working on a patch.<\/strong><\/em><\/p>\n

These vulnerabilities are very similar to vulnerabilities reported last year called ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207). The vulnerability has been labeled in the cybersecurity community (see Twitter @GossiTheDog) as #ProxyNotShell<\/a>.
Until there is a patch, it is highly recommended to follow mitigation and detection guidelines to help customers protect themselves from these attacks.<\/p>\n

Microsoft Exchange Online already has detection and mitigation to protect customers. Only environments with Microsoft Exchange Server (on-premises or hybrid, versions Server 2013, Server 2016, Server 2019) are potentially vulnerable.<\/p>\n

Update October 3, 2022:<\/i><\/b><\/span><\/span><\/span><\/p>\n

Microsoft has published an update to the “Customer Guidance” article.<\/span><\/p>\n