Full Report
The Huntress team is currently investigating new 0-day vulnerabilities in Microsoft Exchange servers, piggybacking on ProxyShell and ProxyLogon.
Analysis Summary
# Vulnerability: ProxyNotShell (Authenticated RCE Chain)
## CVE Details
* **CVE ID:** CVE-2022-41040, CVE-2022-41082
* **CVSS Score:** Not explicitly listed in text (Historically 8.8 High / 6.3 Medium as a chain)
* **CWE:**
* CVE-2022-41040: CWE-918 (Server-Side Request Forgery)
* CVE-2022-41082: CWE-94 (Remote Code Execution via PowerShell)
## Affected Systems
* **Products:** Microsoft Exchange Server
* **Versions:** On-premises versions including 2013, 2016, and 2019.
* **Configurations:** Systems running a hybrid configuration (migrated to Exchange Online but maintaining on-prem servers) are also confirmed to be vulnerable.
## Vulnerability Description
This is a two-stage attack chain known as "ProxyNotShell."
1. **CVE-2022-41040 (SSRF):** Allows an authenticated attacker to trigger a request from the Exchange server to an internal endpoint.
2. **CVE-2022-41082 (RCE):** Allows the attacker to leverage the SSRF to access the PowerShell remoting service, enabling the execution of arbitrary commands.
Note: While similar to ProxyShell, this requires the attacker to be **authenticated**.
## Exploitation
* **Status:** Exploited in the wild (0-day).
* **Complexity:** Medium (Requires valid user credentials).
* **Attack Vector:** Network (Authenticated).
## Impact
* **Confidentiality:** High (Full data access via RCE).
* **Integrity:** High (Ability to modify system files and backdoors).
* **Availability:** High (Potential for system shutdown or ransomware deployment).
## Remediation
### Patches
* As of the report date (September 30, 2022), **no official patch is available.** Current Cumulative Updates (CU) do not mitigate the flaw.
### Workarounds
* **IIS Rewrite Rules:** Implement URL Rewrite rules to block known exploit patterns. Specifically, filter the request URI for strings matching: `.*autodiscover\.json.*Powershell.*`
* **Disable PowerShell Remoting:** Block Remote PowerShell for non-admin users where possible.
## Detection
* **Indicators of Compromise (IoCs):**
* Presence of specific webshells: `Backdoor:ASP/Webshell.Y` and `Backdoor:Win32/RewriteHttp.A`.
* Review IIS logs for requests to `autodiscover.json` containing the `Powershell` string.
* **Detection Tools:**
* Microsoft Defender Antivirus (definitions updated to detect current webshells).
* Huntress Managed AV monitoring for the specific signatures mentioned above.
## References
* [Microsoft Security Response Center (MSRC) Advisory] hxxps://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/
* [GTSC Technical Blog] hxxps://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
* [Huntress Original Source] hxxps://www.huntress.com/blog/new-0-day-vulnerabilities-found-in-microsoft-exchange