{"uuid": "23a8e453-f3dd-4850-b0e4-5d912c61599b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-41082", "type": "seen", "source": "https://t.me/hacking_Attack/83429", "content": "Black Hat Ethical Hacking\nOver 60,000 Exchange servers vulnerable to ProxyNotShell attacks\n\nOver 60,000 Exchange servers vulnerable to ProxyNotShell attacksPost Views: 2 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes More than 60,000 Microsoft Exchange servers exposed online are yet to be patched against the CVE-2022-41082 remote code execution (RCE) vulnerability, one of the two security flaws targeted by ProxyNotShell exploits.According to a recent tweet\u00a0from security researchers at the Shadowserver Foundation, a nonprofit organization dedicated to improving internet security, almost 70,000 Microsoft Exchange servers were found to be vulnerable to ProxyNotShell attacks according to version information (the servers\u2019 x_owa_version header).\n\nHowever, new data published on Monday shows that the number of vulnerable Exchange servers has decreased\u00a0from 83,946 instances in mid-December to 60,865 detected on January 2nd.\nhttps://www.bleepstatic.com/images/news/u/1109292/2023/Exchange%20servers%20vulnerable%20to%20ProxyNotShell%20attacks.png \n<figcaptionExchange servers vulnerable to ProxyNotShell attacks (Shadowserver Foundation) \nThese two security bugs, tracked as CVE-2022-41082\u00a0and CVE-2022-41040\u00a0and collectively known as ProxyNotShell, affect Exchange Server 2013, 2016, and 2019.\n\nIf successfully exploited, attackers can escalate privileges and gain arbitrary or remote code execution on compromised servers.\n\nMicrosoft released security updates to address the flaws during the November 2022 Patch Tuesday, even though ProxyNotShell attacks have been detected in the wild since at least September 2022.\n\nThreat intelligence company GreyNoise has been tracking ongoing ProxyNotShell exploitation since September 30th and provides information on ProxyNotShell scanning activity\u00a0and a list of IP addresses linked to the attacks.\nhttps://www.bleepstatic.com/images/news/u/1109292/2023/Map%20of%20Exchange%20servers%20unpatched%20against%20ProxyNotShell.jpeg \n<figcaptionMap of Exchange servers unpatched against ProxyNotShell (Shadowserver Foundation) \nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Thousands also\u00a0exposed\u00a0to ProxyShell and ProxyLogon attacksIn order to protect your Exchange servers from incoming attacks, you have to apply the ProxyNotShell patches released by Microsoft in November.\n\nWhile the company also provided mitigation measures, these can be bypassed by attackers, meaning that only fully patched servers are secure from compromise.\n\nAs reported\u00a0by BleepingComputer last month, Play ransomware threat actors are now using a new exploit chain to bypass ProxyNotShell URL rewrite mitigations\u00a0and gain remote code execution on vulnerable servers through Outlook Web Access (OWA).\n\nTo make things even worse, a Shodan search\u00a0reveals a significant number of Exchange servers exposed online, with thousands left unpatched against ProxyShell and ProxyLogon vulnerabilities that made it into the top most exploited vulnerabilities\u00a0in 2021.\nhttps://www.bleepstatic.com/images/news/u/1109292/2023/Exchange%20servers%20exposed%20online.png \n<figcaptionExchange servers exposed online (Shodan) \nExchange servers are valuable targets, as demonstrated by the financially motivated FIN7 cybercrime group which has developed a custom auto-attack platform known as Checkmarks and designed to breach Exchange servers.\nTrending: Operation OpRussia \u2013 Anonymous attacks on Russia\nTrending: Offensive Security Tool: OrbitalDump According to threat intelligence firm Prodaft, which discovered the platform, it scans for and exploits various Microsoft Exchange remote[...]", "creation_timestamp": "2026-09-02T01:01:28.589053Z"}