On Microsoft Exchange Server, security researchers have discovered a new exploit that enables attackers to remotely execute code over Outlook Web Access (OWA).
According to Crowdstrike, the new exploit approach overcomes the URL or link rewrite mitigations for the ProxyNotShell problem that Microsoft released and which affects on-premises Exchange servers by using two vulnerabilities.
The exploit technique was known as OWASSRF, or Outlook Web Access Server-Side Request Forgery, by the security provider.
According to Crowdstrike researchers, the frontend receives an authenticated request to access the Autodiscover endpoint, which is used to notify clients about the services provided by the remote Microsoft Exchange server.
Utilizing the path confusion vulnerability CVE-2022-41040, the attacker can access the backend for any URL.
An example of this kind of vulnerability is a server-side request forgery (SSRF).
The Remote PowerShell service is the backend service that ProxyNotShell is targeting.
A few days later, Rackspace acknowledged that a ransomware attack by unidentified criminals was to blame for the downtime, which required the company’s support staff to engage in time-consuming data recovery procedures for clients.
According to Rackspace, Crowdstrike was engaged to help with the ransomware attack investigation.
Because URL rewrite mitigations for ProxyNotShell are ineffective, according to Crowdstrike, Exchange administrators should implement Microsoft’s November fixes to stop exploitation.
Administrators who are unable to fix their Exchange servers right away should stop OWA as soon as they can and, if at all possible, adhere to Microsoft’s advice to turn off remote PowerShell for non-administrative users.
