Full Report
Huntress' analysis of a new exploit chain (called OWASSRF) that can lead to critical remote code execution on unpatched Exchange hosts.
Analysis Summary
# Vulnerability: OWASSRF (Exchange RCE Exploit Chain)
## CVE Details
- **CVE ID:** CVE-2022-41080 (Privilege Escalation) and CVE-2022-41082 (Remote Code Execution)
- **CVSS Score:** 8.8 (High) / 9.8 (Critical)
- **CWE:** CWE-918 (Server-Side Request Forgery), CWE-502 (Deserialization of Untrusted Data)
## Affected Systems
- **Products:** Microsoft Exchange Server
- **Versions:** 2013, 2016, and 2019
- **Configurations:** Systems that have not applied the November 2022 security updates. The exploit specifically targets the Outlook Web Access (OWA) service.
## Vulnerability Description
OWASSRF is an exploit chain that bypasses previous URL-rewrite mitigations for ProxyNotShell. The flaw leverages **CVE-2022-41080**, which allows an attacker to access the PowerShell remoting endpoint via OWA (specifically `/owa/mastermailbox%40outlook.com/powershell`) using a Server-Side Request Forgery (SSRF). Once access to the PowerShell backend is achieved, the attacker utilizes **CVE-2022-41082** to perform unsafe deserialization, leading to Remote Code Execution (RCE) on the target host as `NT AUTHORITY\SYSTEM`.
## Exploitation
- **Status:** Exploited in the wild. High volume of attacks observed delivering ScreenConnect (ConnectWise Control) for persistence.
- **Complexity:** Low to Medium (Requires valid, unprivileged user credentials).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Full access to data and mailboxes)
- **Integrity:** High (Ability to execute arbitrary commands and modify system files)
- **Availability:** High (Potential for ransomware or system shutdown)
## Remediation
### Patches
- Microsoft released official patches in the **November 2022 Security Update**. Organizations must ensure their Exchange Servers are updated to at least the November 2022 CU/SU levels.
### Workarounds
- **Disable PowerShell Remoting:** Disable PowerShell remoting for non-administrative users where possible.
- **URL Rewriting:** While previous mitigations were bypassed by this specific chain, keeping OWA access restricted to VPN/Trusted IP ranges reduces the attack surface.
## Detection
- **Indicators of Compromise (IoCs):**
- Rogue ScreenConnect instance IDs (e.g., `6db95d58cdf0a1a3` or `b81d2f07c9163bf5`).
- Use of `bitsadmin.exe` to download external tools from suspicious IPs (e.g., `179.60.149[.]28`).
- Malicious PowerShell execution originating from the `w3wp.exe` process (IIS).
- **Detection Methods:**
- Monitor IIS logs for requests to `/owa/` containing `%40outlook.com/powershell`.
- Audit for unusual `NT AUTHORITY\SYSTEM` PowerShell sessions spawned by the Exchange Mailbox role.
## References
- **Vendor Advisory:** [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082)
- **Huntress Analysis:** [https://www.huntress.com/blog/owassrf-explained-analyzing-the-microsoft-exchange-rce-vulnerability](https://www.huntress.com/blog/owassrf-explained-analyzing-the-microsoft-exchange-rce-vulnerability)
- **Crowdstrike Analysis:** [https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/](https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/)