Zero-day RCE vulnerability on Microsoft Exchange Servers (CVE-2022-41040 & CVE-2022-41082)

It was recently reported by Microsoft and other outlets that a Zero-day vulnerability on Exchange Servers 2013, 2016, and 2019 has been exploited by malicious threat actors. This is a rapidly evolving exploit, but here is the latest information and guidance available.

Nov 20, 2024
Knowledge

Title

URL Name

Zero-day-RCE-vulnerability-on-Microsoft-Exchange-Servers-CVE-2022-41040-CVE-2022-41082

Article Number

000270846

Environment

Product: Any Version:Any Platform:Any Application:Microsoft Exchange 2013, 2016, and 2019

Question/Problem Description

This Exchange Server exploit allows malicious threat actors to gain remote access to internal systems by performing Remote Code Execution (RCE) on the compromised system using PowerShell.

Steps to Reproduce

Clarifying Information

Error Message

Defect Number

Enhancement Number

Cause

The first vulnerability, identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, while the second, identified as CVE-2022-41082, allows remote code execution (RCE) when PowerShell is accessible to the attacker.

Resolution

Microsoft has provided some mitigations via the Microsoft Security Response Center Blog post below. It involves creating a URL Rewrite block rule on the Exchange server via IIS Manager under the Autodiscover virtual directory to block the specific PowerShell URL syntax used for gaining remote access over Autodiscover. This can also be achieved on the LoadMaster. Please see the Workaround section below.

https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/

Workaround

Alternatively, the URL Rewrite block rule can be created as a Content Rule on the LoadMaster and applied to the Exchange Virtual Service. Here are some steps on how to achieve this on the LoadMaster:

Navigate to Rules & Checking > Content Rules > Create New.
For the syntax of this Content Rule, please see below: Match String Syntax: /(?=.*autodiscover)(?=.*powershell)/
Create this rule as per step 2 above, and then navigate to and click Modify on the Exchange Virtual Service on the LoadMaster. This rule should be applied on the parent Virtual Service level to apply to all relevant Exchange Sub Virtual Service directories (Autodiscover, API, PowerShell etc).
Go to Advanced Properties on the parent Virtual Service level, then go to HTTP Selection Rules and click on Show Selection Rules. Here, add the "Zero_day_block" Content Rule that was created in step 2 above. This would be the result once the rule has been added successfully:
Click Back to return to the Advanced Properties section and go to Not Available Redirection Handling. Here, set the Error code as "403" and enter an Error Message such as "Blocked Access". Please see the attached screenshot below as an example of this configuration:
With these steps in place, now attempt to navigate to the Fully Qualified Domain Name (FQDN) of the Exchange Virtual Service using the blocked string syntax. As a result, a 403 Forbidden response should be returned with the "Blocked Access" error message in the web browser. Example malicious FQDN: https://mail.domain.com/autodiscover.json@Powershell