New zero-day exploit in Microsoft Exchange Server – Greenbone Enterprise Feed offers protection

We have developed a remote test for the Microsoft Exchange Server ProxyNotShell vulnerability GTSC2022.

---

Update from 2022-10-13: The vulnerability still exists after the October patchday on Tuesday. The blog post of Microsoft’s Security Response Center is continuously updated by the company, the last entry is from October 08.

---

The mentioned zero-day exploit in Microsoft Exchange Servers [GTSC2022] was published on September 28th by the cyber security company GTSC. After investigating a security incident, the security researchers discovered evidence of active exploitation of two vulnerabilities that can be used to compromise even fully patched systems.

The test (check here) extends our current vulnerability detection for Outlook Web Access (OWA) by checking whether Microsoft’s suggested remedies are in place. So far (beginning of October 2022), Microsoft only recommends workarounds. Microsoft Exchange users can use our test to ensure that the workaround instructions are implemented and active. Our customers can simply continue to use their Greenbone product, the test is already implemented in the feed. Those who do not yet have a Greenbone product yet, please use the link (check here) above.

Information on the technical background

Microsoft has published a post on its website [MSRC2022] describing that the vulnerabilities allow server-side request forgery (CVE-2022-41040) and remote code execution (CVE-2022-41082) if the attacker has access to PowerShell. However, this requires authenticated access to the vulnerable server (according to Microsoft, the Microsoft Exchange Servers 2013, 2016 and 2019).

The migration measures listed in the Microsoft blog (for example, disabling access to Powershell for unprivileged users) should be implemented as soon as possible by customers with on-premise solutions, as there is currently no known security update that fixes the vulnerability. According to Microsoft, users of Microsoft Exchange Online are not affected.

The severity of the vulnerability

In the Common Vulnerability Scoring System (CVSS), the vulnerabilities were rated as “high” and “medium” with a severity score of 8.8 and 6.3 out of 10, respectively. Since the vulnerabilities are already being actively exploited by attackers, there is also an increased risk of compromise for German institutions.

Sustainable protection of your IT Networks

If you want to know which systems in your network are (still) vulnerable to vulnerabilities – including the ProxyNotShell vulnerability – our vulnerability management helps you. It is used in systems that must be patched or otherwise protected in any case. Depending on the type of systems and vulnerabilities, they can be found better or worse. The detection is also constantly improving and being updated. New gaps are found. Therefore, there may always be more systems with vulnerabilities in the network. Therefore, it is worthwhile to regularly update and scan all systems. The Greenbone vulnerability management offers corresponding automation functions for this.

Our vulnerability management offers the best protection

Vulnerability management is an indispensable part of IT security. It can find risks and provides valuable information on how to eliminate them. However, no single measure offers 100% security, not even vulnerability management. To make a system secure, many systems are used, which in their entirety should provide the best possible security.