{"uuid": "f1fe2fe5-bfc8-402e-b3c0-841e6439c0e5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-41082", "type": "seen", "source": "https://t.me/hacking_Attack/71626", "content": "Black Hat Ethical Hacking\nMicrosoft confirms zero-day exploits against Exchange Server in \u2018limited\u2019 attacks\n\nMicrosoft confirms zero-day exploits against Exchange Server in \u2018limited\u2019 attacksPost Views: 8 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes Microsoft is developing a patch for two actively exploited zero-day vulnerabilities in Microsoft Exchange Server.The flaws, tracked as CVE-2022-41040\u00a0and CVE-2022-41082, were discovered in Microsoft\u2019s enterprise mail server by Vietnamese cybersecurity firm GTSC. Microsoft said it is aware of \u201ca small number of targeted attacks\u201d exploiting the flaws, which impact on-prem Microsoft Exchange Server versions 2013, 2016, and 2019.\n\nThe bugs appear to be less dangerous variants \u2013 on account of authentication to PowerShell being required \u2013 of the critical ProxyShell\u00a0vulnerabilities that were widely abused in 2021. RCE chainIn GTSC\u2019s original security advisory, researchers said they discovered an attack on \u201ccritical\u201d infrastructure made through Exchange Server in August.\n\nThe first vulnerability, CVE-2022-41040 (CVSS 8.8), is a server-side request forgery\u00a0(SSRF) issue. When triggered remotely to launch CVE-2022-41082 (CVSS 6.3), the bug could result in remote code execution (RCE).\n\nAs the vulnerabilities are yet to be patched, the full technical details have not been released \u2013 but proof-of-concept (PoC) code is expected to appear soon.\n\nGTSC informed Trend Micro\u2019s Zero Day Initiative (ZDI) of its findings. After ZDI verified the flaws and reached out to the Microsoft Security Response Center (MSRC), the Redmond giant confirmed the report and published an analysis of attacks\u00a0exploiting the flaws.\n\n\u201cAuthenticated access to the vulnerable Exchange Server is necessary to successfully exploit either vulnerability, and they can be used separately,\u201d Microsoft noted.\n\nUnfortunately, the authentication required is nothing more than a standard user. As a result, cybercriminals could obtain these credentials via theft, credential stuffing, and brute-force attacks.\nSee Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course State-sponsored attacksAccording to Microsoft, fewer than 10 organizations worldwide have been targeted by what is likely a \u201cstate-sponsored organization\u201d.\n\nGTSC researchers said there are indicators that a Chinese threat group is leveraging Antsword, a Chinese cross-platform website management suite with web shell functionality.\n\nChina Chopper, a web shell, has apparently been used to perform Active Directory reconnaissance and data exfiltration. If this sounds familiar, the same web shell\u00a0was used in attacks exploiting Exchange Server zero-day vulnerabilities in 2021. These attacks were attributed to the state-sponsored Chinese threat group HAFNIUM.\n\n\u200bSecurity researcher Kevin Beaumont has noted similarities between the paths used by the new bugs, which he has dubbed \u2018ProxyNotShell\u2019, and the zero days from last year.\n\nDevcore researcher Orange Tsai, who discovered the original, ProxyShell flaws, suggested in a talk at Black Hat USA\u00a0(PDF) last year that fundamental path confusion issues could see further ProxyShell variants emerge \u2013 a prediction that has now come to pass.\nTrending: A primer on OS Command Injection Attacks\nTrending: Recon Tool: ReconSpider Mitigation adviceMicrosoft has released customer guidance\u00a0for mitigating the new bugs while it works on a patch.\n\nThe company is urging customers to disable remote PowerShell access for non-administrators immediately. If the Exchange Emergency Mitigation Service (EEMS) is enabled, further mitigation[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:36.598379Z"}