WARNING: Ransomware actors are actively exploiting a new exploit method dubbed OWASSRF, Patch Immediately !
CVE-2022-41080
CVE-2022-41082
Sources
https://www.crowdstrike.com/blog/owassrf-exploit-analysis-and-recommendations/
Risques
CrowdStrike discovered a new method dubbed OWASSRF that can bypass the recommended mitigations of Microsoft. Threat actors can leverage this new method to gain remote code execution (RCE) through Outlook Web Access (OWA).
These vulnerabilities are actively exploited by ransomware actors, in particular the Play ransomware group.
Microsoft Exchange is a commonly used mail server and calendar server developed by Microsoft. Outlook Web Access (OWA) is the webmail service used by Microsoft Exchange.
Your organization likely has an on-premises Microsoft Outlook server with OWA functionality.
The Centre for Cyber security Belgium recommends system administrators to patch vulnerable systems as soon as possible and to analyse system and network logs for any suspicious activity.
If your organization has already identified an intrusion or incident, please report it via: https://cert.be/en/report-incident.
Description
On December 20, 2022 Crowdstrike published a novel use of previously disclosed vulnerabilities dubbed ProxyNotShell.
An authenticated remote attacker can use CVE-2022-41080 for privilege escalation and chain it with CVE-2022-41082 for remote code execution (RCE.)
The above attack chain is dubbed OWASSRF and results in remote code execution (RCE) through an Outlook Web Access (OWA) endpoint.
Threat actors can bypass the mitigations that were released In October by Microsoft for ProxyNotShell https://microsoft.github.io/CSS-Exchange/Security/EOMTv2/.
To prevent ProxyNotShell exploitation on older Microsoft Exchange servers, Microsoft recommended to use a custom rewrite rule for the Autodiscover endpoint. when a decoded URI matches this regex, the request is dropped.
Threat actors are circumventing the Regex rule by bypassing the Autodiscover endpoint and using an OWA Endpoint, in this case the rule is not triggered and the request is executed.
Patch Tuesday November 2022 includes a patch for both vulnerabilities.
TECHNICAL DETAILS
CVE-2022-41080 -Microsoft Exchange Server Elevation of Privilege Vulnerability
The attack complexity for this vulnerability is low and successful exploitation is more likely. It is unclear if CVE-2022-41080 was exploited as a zero-day before it was patched.
This vulnerability is now actively exploited.
CVE-2022-41082 - Microsoft Exchange Server Elevation of Privilege and Microsoft Exchange Server Remote Code Execution Vulnerability
This vulnerability was disclosed at the end of September 2022, and actively exploited.
Actions recommandées
Scope
- Check if your organization runs an on-premises Microsoft Exchange server with OWA enabled.
Patch
- Apply the Patch Tuesday November 8, 2022, patches for Exchange to prevent exploitation.
- The URL rewrite mitigations for ProxyNotShell are not effective against this exploit method.
Microsoft:
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41080 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082
Mitigate
- Disable OWA , if you have an unpatched vulnerable Exchange Server
Monitor / Detect
- Deploy advanced endpoint detection and response (EDR) tools to all endpoints to detect web services spawning PowerShell or command line processes.
- Ensure the X-Forwarded-For header is configured to log true external IP addresses for a request to proxied services
- Crowdstrike has created a script to check IIS and Powershell logs for possible exploitation. https://github.com/CrowdStrike/OWASSRF
Harden
- Disable remote PowerShell for non-administrative users where possible
- Disable remote PowerShell for non-administrative users where possible.
- Consider application-level controls such as web application firewalls.
- Consider MFA as an extra security control
Références
https://cert.be/en/two-zero-day-vulnerabilities-microsoft-exchange-server-dubbed-proxynotshell-pose-risk-remote-code
https://cert.be/en/warning-microsoft-patch-tuesday-november-2022-patches-62-vulnerabilities-9-critical-6-actively
https://github.com/CrowdStrike/OWASSRF