FortiGuard Labs is aware of reports that threat actors are using a combination of ProxyNotShell vulnerabilities (CVE-2022-41040 and CVE-2022-41082) in combination with Outlook Web Access (OWA) and a server side request forgery (SSRF) in a new exploit chain utilizing PowerShell to obtain a foothold and deliver malware (tools, Play ransomware) within a targeted environment ultimately for persistence. The new exploit vector is a Server Side Request Forgery (SSRF) attack on Outlook Web Access (OWA) which is being dubbed as OWASSRF. According to Microsoft, the URL rewrite mitigations published on September 29 for organizations that have not patched are no longer recommended.ProxyNotShell OverviewEarlier in September, Microsoft disclosed two new 0-day vulnerabilities affecting Microsoft Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019. They are:CVE-2022-41040 – a server-side request forgery (SSRF) vulnerability (CVSS 8.8)CVE-2022-41082 – allows for remote code execution (RCE) when Exchange PowerShell is accessible to the attacker (CVSS 8.8)Note:Although patches were released for CVE-2022-41040 and CVE-2022-41082, in November 2022, and will prevent successful exploitation; mitigation for organizations that have not patched are susceptible to this new attack vector.On a positive note and alleviating fears for organizations – the impact is lessened as attackers will need to have advanced knowledge of Exchange server credentials to the victim’s environment to successfully exploit this new vector.FortiGuard Labs recently published an Outbreak Alert and a blog for ProxyNotShell. See the Appendix for links to “Outbreak Alert: Microsoft Exchange ProxyNotShell Vulnerabilities” and “Microsoft Exchange 0-Day Vulnerability Updates”Why is this Significant?Although Microsoft released patches in November 2022, the two vulnerabilities (CVE-2022-41040 and CVE-2022-41082) are chained together and used in conjunction with Outlook Web Access in a SSRF attack bypassing previous recommended mitigation. Microsoft Exchange servers that are patched are believed to be not vulnerable. How Widespread Are Attacks?Because the exploit chain requires attackers to obtain credentials of compromised Exchange accounts beforehand; attacks are limited to targeted attacks.Has the Vendor Released a Patch for CVE-2022-41040 and CVE-2022-41082?Yes, Microsoft released a patch on November 8, 2022, as part of the regular Microsoft Patch Tuesday cycle.What is Play Ransomware?Play is a relatively new ransomware that was first detected in June 2022. Play ransomware encrypts files on victims’ machines and adds a “.play” extension to them. The ransomware adopted the double-extortion methodology of encrypting endpoints and/or other infrastructure of value within an organization and then threatening to release exfiltrated data from those machines on the internet if a ransom is not paid.Play ransomware is covered in a recent Ransomware Roundup blog. For details, see the Appendix for a link to “Ransomware Roundup – Play Ransomware”.Any Recommended Mitigation?FortiGuard Labs recommends that all organizations apply the latest patches from the November 2022 Exchange Server Security Update to avoid any possible compromise to the OWASSRF vector. Microsoft no longer recommends URL rewrite mitigation for those not patched. Also, it is suggested that system administrators disable remote PowerShell for non admin users where possible.What is the Status of Protection?Customers running the latest definitions are protected against known ProxyNotShell attempts by the following IPS signatures:MS.Exchange.Server.OWA.Remote.Code.Execution (CVE-2022-41080)MS.Exchange.Server.Autodiscover.Remote.Code.Execution (CVE-2022-41082)
Category Archives: Advisories
pgadmin4-6.18-2.fc37
FEDORA-2023-496439cbdd
Packages in this update:
pgadmin4-6.18-2.fc37
Update description:
Update to 6.18. Backport fix for CVE-35065 of bundled glob-parent.
yarnpkg-1.22.19-2.fc37
FEDORA-2023-8d4b772755
Packages in this update:
yarnpkg-1.22.19-2.fc37
Update description:
Update to 1.22.19. Backport patch for CVE-2021-35065 for bundled glob-parent.
yarnpkg-1.22.19-2.fc36
FEDORA-2023-5c6f32db6f
Packages in this update:
yarnpkg-1.22.19-2.fc36
Update description:
Update to 1.22.19. Backport patch for CVE-2021-35065 for bundled glob-parent.
viewvc-1.1.29-1.el7
FEDORA-EPEL-2023-96ef72f1b2
Packages in this update:
viewvc-1.1.29-1.el7
Update description:
Fix for CVE-2023-22456: https://github.com/viewvc/viewvc/releases/tag/1.1.29
pypy3.8-7.3.11-1.3.8.fc36
FEDORA-2023-78b4ce2f23
Packages in this update:
pypy3.8-7.3.11-1.3.8.fc36
Update description:
Update to 7.3.11. See https://doc.pypy.org/en/latest/release-v7.3.11.html
Security fix for CVE-2022-37454, CVE-2022-45061.
mingw-binutils-2.37-6.fc36
FEDORA-2023-11256597a8
Packages in this update:
mingw-binutils-2.37-6.fc36
Update description:
Backport fix for CVE-2022-4285.
mingw-binutils-2.38-6.fc37
FEDORA-2023-3d9f2bed46
Packages in this update:
mingw-binutils-2.38-6.fc37
Update description:
Backport fix for CVE-2022-4285.
pypy3.9-7.3.11-1.3.9.fc37
FEDORA-2023-af5206f71d
Packages in this update:
pypy3.9-7.3.11-1.3.9.fc37
Update description:
Update to 7.3.11. See https://doc.pypy.org/en/latest/release-v7.3.11.html
Security fix for CVE-2022-37454, CVE-2022-45061, CVE-2022-42919.
pypy3.8-7.3.11-1.3.8.fc37
FEDORA-2023-943556a733
Packages in this update:
pypy3.8-7.3.11-1.3.8.fc37
Update description:
Update to 7.3.11. See https://doc.pypy.org/en/latest/release-v7.3.11.html
Security fix for CVE-2022-37454, CVE-2022-45061.