Two New 0-Day Flaws in Exchange Server – Krebs on Security

Microsoft Corp. is investigating reviews that attackers are exploiting two beforehand unknown vulnerabilities in Trade Server, a know-how many organizations depend on to ship and obtain electronic mail. Microsoft says it’s expediting work on software program patches to plug the safety holes. Within the meantime, it’s urging a subset of Trade prospects to allow a setting that would assist mitigate ongoing assaults.

In buyer steering launched Thursday, Microsoft mentioned it’s investigating two reported zero-day flaws affecting Microsoft Trade Server 2013, 2016, and 2019. CVE-2022-41040, is a Server-Aspect Request Forgery (SSRF) vulnerability that may allow an authenticated attacker to remotely set off the second zero-day vulnerability — CVE-2022-41082 — which permits distant code execution (RCE) when PowerShell is accessible to the attacker.

Microsoft mentioned Trade On-line has detections and mitigation in place to guard prospects. Prospects utilizing on-premises Microsoft Trade servers are urged to evaluation the mitigations advised within the safety advisory, which Microsoft says ought to block the recognized assault patterns.

Vietnamese safety agency GTSC on Thursday revealed a writeup on the 2 Trade zero-day flaws, saying it first noticed the assaults in early August getting used to drop “webshells.” These web-based backdoors supply attackers an easy-to-use, password-protected hacking instrument that may be accessed over the Web from any browser.

“We detected webshells, largely obfuscated, being dropped to Trade servers,” GTSC wrote. “Utilizing the user-agent, we detected that the attacker makes use of Antsword, an energetic Chinese language-based opensource cross-platform web site administration instrument that helps webshell administration. We suspect that these come from a Chinese language assault group as a result of the webshell codepage is 936, which is a Microsoft character encoding for simplified Chinese language.”

GTSC’s advisory consists of particulars about post-compromise exercise and associated malware, in addition to steps it took to assist prospects reply to energetic compromises of their Trade Server setting. However the firm mentioned it might withhold extra technical particulars of the vulnerabilities for now.

In March 2021, a whole lot of hundreds of organizations worldwide had their electronic mail stolen and a number of backdoor webshells put in, all because of 4 zero-day vulnerabilities in Trade Server.

Granted, the zero-day flaws that powered that debacle have been way more important than the 2 detailed this week, and there are not any indicators but that exploit code has been publicly launched (that may doubtless change quickly). However a part of what made final 12 months’s Trade Server mass hack so pervasive was that weak organizations had little or no advance discover on what to search for earlier than their Trade Server environments have been utterly owned by a number of attackers.

Microsoft is fast to level out that these zero-day flaws require an attacker to have a legitimate username and password for an Trade person, however this will not be such a tall order for the hackers behind these newest exploits in opposition to Trade Server.

Steven Adair is president of Volexity, the Virginia-based cybersecurity agency that was among the many first to sound the alarm in regards to the Trade zero-days focused within the 2021 mass hack. Adair mentioned GTSC’s writeup consists of an Web tackle utilized by the attackers that Volexity has tied with excessive confidence to a China-based hacking group that has just lately been noticed phishing Trade customers for his or her credentials.

In February 2022, Volexity warned that this identical Chinese language hacking group was behind the mass exploitation of a zero-day vulnerability within the Zimbra Collaboration Suite, which is a competitor to Microsoft Trade that many enterprises use to handle electronic mail and different types of messaging.

In case your group runs Trade Server, please contemplate reviewing the Microsoft mitigations and the GTSC autopsy on their investigations.