Exchange Server 0-Day Actively Exploited, (Fri, Sep 30th)

This post was originally published on this site

In a blog post, Vietnamese security company GTSC noted that they saw evidence of a new "ProxyShell" like vulnerability being exploited in the wild. The evidence came from compromised Exchange servers GTSC observed when responding to incidents [1]. Later, Trend Micro confirmed that two vulnerabilities tracked by Trend Micro's zero-day initiative were involved in the compromise described by GTSC [2]. Trend Micro had reported the vulnerabilities to Microsoft about a month ago.

Microsoft has now published a blog post with its own guidance [3]

Microsoft identified two vulnerabilities as contributing to the recent incidents:

CVE-2022-41040: A Server Side Request Forgery (SSRF) issue. 
CVE-2022-41082: A remote code execution (RCE) issue.

The SSRF vulnerability can be used to trigger the RCE vulnerability. An attacker does need to be authenticated to exploit the SSRF vulnerability. 

No patch is available if you run Microsoft Exchange on premise, but you can use URL rewrite rules to prevent exploitation. Post exploitation, rules in Microsoft Sentinel and Microsoft Defender for Endpoint can be used to detect webshells and HTTP rewrite payloads installed by attackers.

There is no word as to a possible patch being released early. But the URL rewrite workaround should be sufficient for now. And please make sure all available patches are applied. Microsoft Exchange servers are a top target for attackers these days.


Johannes B. Ullrich, Ph.D. , Dean of Research,

(c) SANS Internet Storm Center. Creative Commons Attribution-Noncommercial 3.0 United States License.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.