Connect with us
Categories:
X

Technology

Microsoft confirms zero-day exploits against Exchange Server in limited attacks

Published

on

Microsoft confirms zero-day exploits against Exchange Server in limited attacks
Share this post:

Microsoft is developing a patch for two actively exploited zero-day vulnerabilities in Microsoft Exchange Server.

The flaws, tracked as CVE-2022-41040 and CVE-2022-41082, were discovered in Microsoft’s enterprise mail server by Vietnamese cybersecurity firm GTSC. Microsoft said it is aware of “a small number of targeted attacks” exploiting the flaws, which impact on-prem Microsoft Exchange Server versions 2013, 2016, and 2019.

The bugs appear to be less dangerous variants – on account of authentication to PowerShell being required – of the critical ProxyShell vulnerabilities that were widely abused in 2021.

RCE chain

In GTSC’s original security advisory, researchers said they discovered an attack on “critical” infrastructure made through Exchange Server in August.

The first vulnerability, CVE-2022-41040 (CVSS 8.8), is a server-side request forgery (SSRF) issue. When triggered remotely to launch CVE-2022-41082 (CVSS 6.3), the bug could result in remote code execution (RCE).

As the vulnerabilities are yet to be patched, the full technical details have not been released – but proof-of-concept (PoC) code is expected to appear soon.

GTSC informed Trend Micro’s Zero Day Initiative (ZDI) of its findings. After ZDI verified the flaws and reached out to the Microsoft Security Response Center (MSRC), the Redmond giant confirmed the report and published an analysis of attacks exploiting the flaws.

“Authenticated access to the vulnerable Exchange Server is necessary to successfully exploit either vulnerability, and they can be used separately,” Microsoft noted.

Unfortunately, the authentication required is nothing more than a standard user. As a result, cybercriminals could obtain these credentials via theft, credential stuffing, and brute-force attacks.

State-sponsored attacks

According to Microsoft, fewer than 10 organizations worldwide have been targeted by what is likely a “state-sponsored organization”.

GTSC researchers said there are indicators that a Chinese threat group is leveraging Antsword, a Chinese cross-platform website management suite with web shell functionality.

China Chopper, a web shell, has apparently been used to perform Active Directory reconnaissance and data exfiltration. If this sounds familiar, the same web shell was used in attacks exploiting Exchange Server zero-day vulnerabilities in 2021. These attacks were attributed to the state-sponsored Chinese threat group HAFNIUM.

Security researcher Kevin Beaumont has noted similarities between the paths used by the new bugs, which he has dubbed ‘ProxyNotShell’, and the zero days from last year.

Devcore researcher Orange Tsai, who discovered the original, ProxyShell flaws, suggested in a talk at Black Hat USA (PDF) last year that fundamental path confusion issues could see further ProxyShell variants emerge – a prediction that has now come to pass.

Mitigation advice

Microsoft has released customer guidance for mitigating the new bugs while it works on a patch.

The company is urging customers to disable remote PowerShell access for non-administrators immediately. If the Exchange Emergency Mitigation Service (EEMS) is enabled, further mitigations will be applied automatically.

According to the tech giant, Exchange Online customers do not need to take any action. However, Beaumont has queried the wisdom of this statement, given that Microsoft Exchange Online migration involves using hybrid, internet-facing Exchange servers.

“It is expected that similar threats and overall exploitation of these vulnerabilities will increase, as security researchers and cybercriminals adopt the published research into their toolkits and proof of concept code becomes available,” Microsoft commented.

CISA has added the two zero-days to the Known Exploited Vulnerabilities Catalog.

Microsoft told Daily Swig that the company has nothing further to share beyond the published advisories.


Get More Stories Like This On: Facebook: @AllNaijaEntertainment, Twitter: @AllNaijaEntertainment

Angry youths chase Elumelu away as they disrupt PDP campaign in Delta
News9 hours ago

Angry youths chase Elumelu away as they disrupt PDP campaign in Delta

Lai Mohammed
News9 hours ago

FG recovers over N120bn from proceeds of crime – Lai Mohammed

News9 hours ago

Tinubu says Peter Obi, Atiku lack track record to be president

Atiku Abubakar
News10 hours ago

Plateau PDP set to receive Atiku

Peter Obi praises Gov Uzodimma’s leadership style
News10 hours ago

Peter Obi praises Gov Uzodimma’s leadership style

Entertainment10 hours ago

‘Free Mind’ by Tems enters 20th week on Billboard Hot 100

Kizz Daniel
Entertainment10 hours ago

Buga by Kizz Daniel is the most searched song in Nigeria in 2022

News10 hours ago

NJC Reinstates Justice Ofili-Ajumogobia As Judge Of Federal High Court

Man sentenced to 21 years in prison for stealing Lady Gaga's dogs
Entertainment10 hours ago

Man sentenced to 21 years in prison for stealing Lady Gaga’s dogs

NNPC Ltd to disclose new asset base – Kyari
News10 hours ago

Nigeria Records ₦‎16 Trillion Worth Of Crude Oil In 9 Months

Entertainment10 hours ago

Broda Shaggi begs African fathers to hug their children

News14 hours ago

Chatham House: APC slams Dele Momodu over comment on Tinubu

News14 hours ago

Samuel Eto’o Apologises After Physically Attacking YouTuber

News14 hours ago

N-Power Fraud: D’banj Arrested & Detained – ICPC Confirms, Releases Statement

News14 hours ago

FG: Second Niger Bridge will open to traffic Dec 15

News14 hours ago

2023 Polls Won’t Mar Nigeria – Sultan, CAN, SGF

Education14 hours ago

ASUU Strike: CONUA threatens to sue FG over withheld salaries

Sports14 hours ago

Eden Hazard announce retirement from international football

News17 hours ago

2023: APC Has Failed Northerners, Muslim-Muslim Ticket Won’t Work – Shagari

News21 hours ago

Teleprompters In Sight As Tinubu Spoke At Chatham House – Jaafar Shares Photo

Buhari
News21 hours ago

2023: No manipulations of any form will be allowed, Buhari vows

News21 hours ago

Kano Hisbah to destroy 18,000 bottles of beer

Entertainment22 hours ago

Emancipation: Will Smith pulls you in with gritty realities of slavery era[Review]

Will Smith hopes ‘brutal’ depictions of slavery in Emancipation are ‘not in vain’, as he attends premiere in London
Entertainment22 hours ago

I became more alive by facing my pain – Will Smith

Luis Enrique
Sports22 hours ago

Spain manager full of praise for his players despite shock Morocco loss

Goncalo Ramos
Sports22 hours ago

Goncalo Ramos reacts after taking Cristiano Ronaldo’s place in Portugal team

Frank Leboeuf
Sports22 hours ago

Frank Leboeuf aims bizarre dig at Kieran Trippier

Sports22 hours ago

Can the Three Lions outsmart France’s unstoppable star player?

Horoscope22 hours ago

Your daily horoscope for Wednesday, December 7, 2022

Sports1 day ago

FIFA World Cup 2022: Goncalo Ramos nets first hat-trick of 2022 FIFA World Cup as Portugal trash Switzerland

Sports1 day ago

FIFA World Cup 2022: Yassine Bono the hero as Morocco knocks Spain out of World Cup

Godwin Emefiele
News1 day ago

CBN Drops ATM Withdrawal Limit To ₦‎20k/Day

News1 day ago

‘TikTok Challenge’ Circulates Info-Stealing Malware – NCC

DOWNLOAD Complete Wednesday (TV series) (2022 film) Season 1 Subtitles File [English SRT] 2022
Movie Subtitle1 day ago

DOWNLOAD Complete Wednesday (TV series) (2022 film) Season 1 Subtitles File [English SRT] 2022

The vast network of antennas will form the world’s largest radio telescope
Technology1 day ago

The largest radio telescope in the world’s construction gets underway

News1 day ago

FG releases new curriculum for universities in Nigeria

News1 day ago

What drives Atiku Abubakar’s desire to sell oil refineries

Wike and Dogara criticize one another for supporting Atiku
News1 day ago

Wike and Dogara criticize one another for supporting Atiku

News1 day ago

Why Tinubu asked his Chatham House team members questions

News1 day ago

Tinubu claim he never lost any election

Troll (2022 film)
Movie Subtitle5 days ago

DOWNLOAD Complete Troll (2022 film) Subtitles File [English SRT] 2022

My Name Is Vendetta (2022 film)
Movie Subtitle5 days ago

DOWNLOAD Complete My Name Is Vendetta (2022 film) Subtitles File [English SRT] 2022

DOWNLOAD Complete Wednesday (TV series) (2022 film) Season 1 Subtitles File [English SRT] 2022
Movie Subtitle1 day ago

DOWNLOAD Complete Wednesday (TV series) (2022 film) Season 1 Subtitles File [English SRT] 2022

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Complete Episodes)

Sven-Goran Eriksson
Sports6 days ago

Who Manchester United should sign instead of Cody Gakpo – Sven-Goran Eriksson

Blood & Water (South African TV series)
Movie Subtitle5 days ago

DOWNLOAD Complete Blood & Water (TV series) (2022 film) Season 3 Subtitles File [English SRT] 2022

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 01)

Aunty Success
Celebrity6 days ago

Top 5 Richest Kid Nigerian Skit Makers And How Their Networth

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 02)

TIMISIRE THE GOLDEN GIRL by Opeyemi Akintunde _ ANE Story
ANE Stories6 days ago

[STORY] TIMISIRE THE GOLDEN GIRL (Episode 20)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 03)

Behind The Fine Face by Moshood Avidiime - ANE Story
ANE Stories6 days ago

[STORY] BEHIND THE FINE FACE (Episode 05)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 06)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 07)

TIMISIRE THE GOLDEN GIRL by Opeyemi Akintunde _ ANE Story
ANE Stories2 days ago

[STORY] TIMISIRE THE GOLDEN GIRL (Episode 22)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Final Episode 31)

Behind The Fine Face by Moshood Avidiime - ANE Story
ANE Stories5 days ago

[STORY] BEHIND THE FINE FACE (Episode 07)

News5 days ago

Buhari Appoints Hairdresser As Boss Of Financial Institution – Lawyers Demand Sack

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 11)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 14)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 04)

TIMISIRE THE GOLDEN GIRL by Opeyemi Akintunde _ ANE Story
ANE Stories5 days ago

[STORY] TIMISIRE THE GOLDEN GIRL (Episode 21)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 19)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 10)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 05)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 08)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 09)

DOWNLOAD Complete Wednesday (TV series) (2022 film) Season 1 Subtitles File [English SRT] 2022
Entertainment2 days ago

Will There Be Wednesday (Tv Series) Season 2, Release Date, Cast, Latest News

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 12)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 23)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 28)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 13)

QATAR 2022 FIFA World Cup changes you ought to know
Sports5 days ago

Qatar World Cup last 16 teams and the fixtures

Blood & Water (South African TV series)
Movie Subtitle5 days ago

DOWNLOAD Complete Blood & Water (TV series) (2020 film) Season 1 Subtitles File [English SRT] 2020

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 16)

Behind The Fine Face by Moshood Avidiime - ANE Story
ANE Stories2 days ago

[STORY] BEHIND THE FINE FACE (Episode 08)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 24)

Behind The Fine Face by Moshood Avidiime - ANE Story
ANE Stories5 days ago

[STORY] BEHIND THE FINE FACE (Episode 06)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 18)

DIARY OF A PASTOR’S SON by Frank The Writer - AllNaijaEntertainment
ANE Stories5 days ago

[STORY] DIARY OF A PASTOR’S SON (Episode 30)

ANE Billboard Hots