CVE-2022-41040 and CVE-2022-41082: ProxyShell Variant Exploited in the Wild

Microsoft has confirmed reports of two zero-day vulnerabilities in Microsoft Exchange Server that have been exploited in the wild. Patches are not yet available.

Background

On September 28, GTSC Cybersecurity Technology Company Limited published a blog post (English translation published later) regarding their discovery of two zero-day vulnerabilities in Microsoft Exchange Server. According to GTSC, its Security Operations Center team discovered the exploitation in August 2022 during its “security monitoring & incident response services.”

GTSC reported these vulnerabilities through Trend Micro’s Zero Day Initiative (ZDI) but, seeing more evidence of exploitation against other targets, decided to publish information about the flaws along with indicators of compromise and mitigation guidance to help organizations defend against attacks.

Late on September 29, Microsoft confirmed the vulnerabilities and assigned CVEs — CVE-2022-41040 and CVE-2022-41082 — but has yet to release patches, stating “we are working on an accelerated timeline to release a fix.”

Analysis

CVE-2022-41040 is an authenticated server-side request forgery vulnerability in Microsoft Exchange Servers that was assigned a CVSSv3 score of 6.3 by ZDI. Exploitation of CVE-2022-41040 could allow an attacker to exploit CVE-2022-41082.

CVE-2022-41082 is an authenticated remote code execution vulnerability assigned a CVSSv3 score of 8.8. It is very similar to ProxyShell, a chain of three vulnerabilities in Exchange Server discovered by Orange Tsai in 2021. However, the original ProxyShell attack chain did not require authentication, while CVE-2022-41082 does.

Looks like a neat variant!

— Orange Tsai 🍊 (@orange_8361) September 29, 2022

Proof of concept

The team at GTSC provided details of the post-exploitation activity it observed in attacks exploiting these vulnerabilities, but were careful not to publish a detailed proof-of-concept (PoC). No public PoC has been identified yet.

Vendor response

At the time of publication, Microsoft has confirmed these vulnerabilities, but has not released patches. It has provided mitigation and detection guidance. Organizations deploying Microsoft Exchange on-prem should follow the instructions provided by Microsoft to add a new blocking rule to the internet information services manager. We will provide updated patching and mitigation guidance once it is available.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities will appear here as they’re released. This link uses a search filter to ensure that all matching plugin coverage will appear as it is released.

Get more information

Join Tenable’s Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.