Black Arrow Cyber Advisory 03/10/2022 – Microsoft Exchange Zero-Days

Updated on 02/11/2022 to reflect the updated mitigation from Microsoft

Updated on 04/10/2022 with additional information on Mitigations and risk to Hybrid Cloud setups.

Updated on 05/10/2022 with updated information on Mitigations from Microsoft

Executive Summary

Two zero-day vulnerabilities have been identified which affect Microsoft Exchange on-premises servers. One of the zero-days allow an attacker to remotely trigger the second zero-day, which would allow a malicious actor to remotely execute code on the server. Both vulnerabilities require authentication with the exchange server, meaning that the attacker would need to already have standard user working credentials.

What’s the risk to me or my business?

Successful exploitation of these vulnerabilities would grant an attacker the ability to remotely execute code on the underlying server, allowing them to perform reconnaissance on the environment and exfiltrate data off the network.

What can I do?

Microsoft is currently working on patches for the vulnerabilities and has released mitigations which are detailed below. Microsoft also recommends disabling remote PowerShell access for non-administrator users to further lower the attack surface. Update: Security researchers have identified that affected Exchange servers are still vulnerable with the Microsoft recommended mitigations in place, and recommend using a more specific block URL when applying the Microsoft Mitigation: “(?=.*autodiscover)(?=.*powershell)” Update 2: Microsoft has updated their mitigation guidance and associated scripts. Please see the “Customer Guidance for Reported Zero-Day” linked below for the latest guidance.

Technical Summary

Microsoft Exchange Online users are not affected by this vulnerability. Update: Hybrid setups which combine Exchange Online with Exchange on-premise are vulnerable to exploitation. The first vulnerability CVE-2022-41040, is a Server-Side Request Forgery (SSRF) Vulnerability, which allows an authenticated attacker to remotely trigger the second vulnerability, which is identified as CVE-2022-41082, and allows Remote Code Execution (RCE) through PowerShell.

Further information on the zero-day vulnerabilities can be found here: Warning: New attack campaign utilized a new 0-day RCE vulnerability on Microsoft Exchange Server | Blog | GTSC - Cung cấp các dịch vụ bảo mật toàn diện (gteltsc.vn) with the recommended mitigations are available here Update 2: this link has been updated by Microsoft with the latest guidance: : Customer Guidance for Reported Zero-day Vulnerabilities in Microsoft Exchange Server – Microsoft Security Response Center Update: Information on latest recommended mitigations can be found here: Microsoft Exchange server zero-day mitigation can be bypassed (bleepingcomputer.com)

Need help understanding your gaps, or just want some advice? Get in touch with us.