Stop us if you've heard this one before: Exchange Server zero-day being actively exploited
(2022/09/30)
- Reference: 1664506986
- News link: https://www.theregister.co.uk/2022/09/30/exchange_server_zero_day/
- Source link:
Security researchers have warned a zero-day flaw in Microsoft’s Exchange server is being actively exploited.
A Vietnamese infosec company called GTSC appears to have identified the flaw with a [1]post explaining how a pair of flaws allow remote code execution on Exchange installations.
The company reported its findings to the Zero Day Initiative which has assigned the code ZDI-CAN-18333 to one flaw rated 8.8 on the ten-point Common Vulnerability Scoring System (CVSS) scale. A second flaw, ZDI-CAN-18802, is rated 6.3/10.
[2]
Details of the flaws are scanty, with GTSC’s post detailing its observations of webshells with Chinese characteristics being dropped onto Exchange servers. Those webshells then “injects malicious DLLs into the memory, drops suspicious files on the attacked servers, and executes these files through the Windows Management Instrumentation Command line (WMIC).
[3]
[4]
That effort leads to the ability to conduct remote code execution, and that seldom ends well.
[5]Microsoft Exchange Autodiscover protocol found leaking hundreds of thousands of credentials
[6]US officials, experts fear China ransacked Exchange servers for data to train AI systems
[7]The torture garden of Microsoft Exchange: Grant us the serenity to accept what they cannot EOL
[8]Microsoft patches critical remote-code-exec hole in Exchange Server and others
[9]It's October 2018, and Microsoft Exchange can be pwned by a plucky eight-year-old... bug
[10]European Banking Authority restores email service in wake of Microsoft Exchange hack
[11]NSA helps out Microsoft with critical Exchange Server vulnerability disclosures in an April shower of patches
At this stage a good ending to this story is hard to envision, because while GTSC has outlined mitigations in its post, Microsoft is yet to issue a fix. History tells me that even once Microsoft publishes a patch, many thousands of Exchange users will not implement it promptly.
To make matters worse, exploits of the flaws are already evident.
GTSC’s post states it’s already seen some of its customers under attack. Infosec analyst Kevin Beaumont tweeted news he’s aware of active attacks, too.
🚨 There’s reports emerging that a new zero day exists in Microsoft Exchange, and is being actively exploited in the wild 🚨
I can confirm significant numbers of Exchange servers have been backdoored - including a honeypot.
Thread to track issue follows: — Kevin Beaumont (@GossiTheDog) [12]September 29, 2022
These flaws are just the latest in a long list of problems with Exchange, Microsoft’s flagship messaging product. The most infamous in recent times was the [13]Hafnium flaw thought to have been the work of Chinese actors. Scarcely a month passes without Microsoft finding other Exchange flaws felt worthy of a Patch Tuesday patch, but the software giant has also recently [14]pledged to improve the server’s security by adopting zero-trust principles for connections to the product. ®
Get our [15]Tech Resources
[1] https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YzZp3B0h-txIstMevvAXmgAAAEE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YzZp3B0h-txIstMevvAXmgAAAEE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YzZp3B0h-txIstMevvAXmgAAAEE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2021/09/22/microsoft_exchange_autodiscover_protocol_found/
[6] https://www.theregister.com/2021/08/31/in_brief_security/
[7] https://www.theregister.com/2021/03/08/column/
[8] https://www.theregister.com/2022/03/09/microsoft_patch_tuesday/
[9] https://www.theregister.com/2018/10/09/october_patch_tuesday/
[10] https://www.theregister.com/2021/03/09/eba_exchange_breach/
[11] https://www.theregister.com/2021/04/13/patch_tuesday_april/
[12] https://twitter.com/GossiTheDog/status/1575580072961982464?ref_src=twsrc%5Etfw
[13] https://www.theregister.com/2021/03/03/hafnium_exchange_server_attack/
[14] https://www.theregister.com/2022/09/28/microsoft_exchange_online_cars/
[15] https://whitepapers.theregister.com/
A Vietnamese infosec company called GTSC appears to have identified the flaw with a [1]post explaining how a pair of flaws allow remote code execution on Exchange installations.
The company reported its findings to the Zero Day Initiative which has assigned the code ZDI-CAN-18333 to one flaw rated 8.8 on the ten-point Common Vulnerability Scoring System (CVSS) scale. A second flaw, ZDI-CAN-18802, is rated 6.3/10.
[2]
Details of the flaws are scanty, with GTSC’s post detailing its observations of webshells with Chinese characteristics being dropped onto Exchange servers. Those webshells then “injects malicious DLLs into the memory, drops suspicious files on the attacked servers, and executes these files through the Windows Management Instrumentation Command line (WMIC).
[3]
[4]
That effort leads to the ability to conduct remote code execution, and that seldom ends well.
[5]Microsoft Exchange Autodiscover protocol found leaking hundreds of thousands of credentials
[6]US officials, experts fear China ransacked Exchange servers for data to train AI systems
[7]The torture garden of Microsoft Exchange: Grant us the serenity to accept what they cannot EOL
[8]Microsoft patches critical remote-code-exec hole in Exchange Server and others
[9]It's October 2018, and Microsoft Exchange can be pwned by a plucky eight-year-old... bug
[10]European Banking Authority restores email service in wake of Microsoft Exchange hack
[11]NSA helps out Microsoft with critical Exchange Server vulnerability disclosures in an April shower of patches
At this stage a good ending to this story is hard to envision, because while GTSC has outlined mitigations in its post, Microsoft is yet to issue a fix. History tells me that even once Microsoft publishes a patch, many thousands of Exchange users will not implement it promptly.
To make matters worse, exploits of the flaws are already evident.
GTSC’s post states it’s already seen some of its customers under attack. Infosec analyst Kevin Beaumont tweeted news he’s aware of active attacks, too.
🚨 There’s reports emerging that a new zero day exists in Microsoft Exchange, and is being actively exploited in the wild 🚨
I can confirm significant numbers of Exchange servers have been backdoored - including a honeypot.
Thread to track issue follows: — Kevin Beaumont (@GossiTheDog) [12]September 29, 2022
These flaws are just the latest in a long list of problems with Exchange, Microsoft’s flagship messaging product. The most infamous in recent times was the [13]Hafnium flaw thought to have been the work of Chinese actors. Scarcely a month passes without Microsoft finding other Exchange flaws felt worthy of a Patch Tuesday patch, but the software giant has also recently [14]pledged to improve the server’s security by adopting zero-trust principles for connections to the product. ®
Get our [15]Tech Resources
[1] https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YzZp3B0h-txIstMevvAXmgAAAEE&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YzZp3B0h-txIstMevvAXmgAAAEE&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YzZp3B0h-txIstMevvAXmgAAAEE&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2021/09/22/microsoft_exchange_autodiscover_protocol_found/
[6] https://www.theregister.com/2021/08/31/in_brief_security/
[7] https://www.theregister.com/2021/03/08/column/
[8] https://www.theregister.com/2022/03/09/microsoft_patch_tuesday/
[9] https://www.theregister.com/2018/10/09/october_patch_tuesday/
[10] https://www.theregister.com/2021/03/09/eba_exchange_breach/
[11] https://www.theregister.com/2021/04/13/patch_tuesday_april/
[12] https://twitter.com/GossiTheDog/status/1575580072961982464?ref_src=twsrc%5Etfw
[13] https://www.theregister.com/2021/03/03/hafnium_exchange_server_attack/
[14] https://www.theregister.com/2022/09/28/microsoft_exchange_online_cars/
[15] https://whitepapers.theregister.com/