ProxyShell Attacks Pummel Unpatched Exchange Servers

Reading Time: 1 Minute

See Also: Critical Valve Bug Lets Gamers Add Unlimited Funds to Steam Wallets

“The configuration file for the Exchange internet service was modified to include a new ‘virtual directory,’ which practically redirects one URL endpoint to another location on the filesystem,” Huntress’ John Hammond wrote.

He explained this helps an attacker hide the webshell outside of areas monitored by ASP directories.

“If you don’t know to look for this, this is going to slip under the radar and the hackers will persist in the target environment. Additionally, the hidden webshell discovered on this host uses the same XML/XLS transform technique that we have seen previously,” Hammond advised.

ProxyShell attacks were first publicly documented at Black Hat in early August by Devcore researcher Orange Tsai. Just a week later, a Shodan scan by the SANS Internet Storm Center’s Jan Kopriva found more than 30,000 vulnerable Exchange Servers.

Yet, many servers remain unpatched against ProxyShell attacks.

See Also: Offensive Security Tool: FFUF

Microsoft Messaging to Blame for Lag in Patching?

Researcher Kevin Beaumont is critical of Microsoft’s messaging efforts surrounding the vulnerability and the critical need for its customers to update their Exchange Server security.

“Microsoft decided to downplay the importance of the patches and treat them as a standard monthly Exchange patch, which [has] been going on for – obviously – decades,” Beaumont explained. “You may remember how much negative publicity March’s Exchange patches caused Microsoft, with headlines such as ‘Microsoft emails hacked’.”

But Beaumont said these remote code execution (RCE) vulnerabilities are “…as serious as they come.”

“To make matters worse, Microsoft failed to allocate CVEs for these vulnerabilities until July – 4 months after the patches were issued,” he wrote. “Given many organizations’ vulnerability [to] manage via CVE, it created a situation where Microsoft’s customers were misinformed about the severity of one of the most critical enterprise security bugs of the year.”

In order of patching priority, according to Beaumont, the vulnerabilities are: CVE-2021–34473, CVE-2021–34523 and CVE-2021–31207.

See Also: Hacking Stories: Andrian Lamo – The ‘homeless’ Hacker

Beaumont said he worked with Shodan to add a plug-in to identify vulnerable systems. He added that Microsoft should be asked to pay bug bounties for on-premise Exchange servers and criticized the company, saying it had “completely failed to deal with their own problems” while openly touting bugs in other vendors’ problems, like Netgear.

For its part, CISA is cautioning every organization to update Exchange software as soon as possible.

“CISA strongly urges organizations to identify vulnerable systems on their networks and immediately apply Microsoft’s Security Update from May 2021 – which remediates all three ProxyShell vulnerabilities – to protect against these attacks,” the alert said.

Source: threatpost.com

(Click Link)