[ad_1]
The operators of a ransomware pressure known as Play have developed a brand new exploit chain for a crucial distant code execution (RCE) vulnerability in Trade Server that Microsoft patched in November.The brand new technique bypasses mitigations that Microsoft had offered for the exploit chain, which means organizations which have solely applied these however have not but utilized the patch for it want to take action instantly.The RCE vulnerability at concern (CVE-2022-41082) is one in all two so-called “ProxyNotShell” flaws in Trade Server variations 2013, 2016, and 2019 that Vietnamese safety firm GTSC publicly disclosed in November after observing a risk actor exploiting them. The opposite ProxyNotShell flaw, tracked as CVE-2022-41040, is a server-side request forgery (SSRF) bug that offers attackers a option to elevate privileges on a compromised system.Within the assault that GTSC reported, the risk actor utilized the CVE-2022-41040 SSRF vulnerability to entry the Distant PowerShell service and used it to set off the RCE flaw on affected techniques. In response, Microsoft beneficial that organizations apply a blocking rule to stop attackers from accessing the PowerShell distant service by the Autodiscover endpoint on affected techniques. The corporate claimed — and safety researchers agreed — that the blocking rule would assist stop identified exploit patterns towards the ProxyNotShell vulnerabilities.Novel New Exploit ChainThis week, nonetheless, researchers at CrowdStrike mentioned that they had noticed the risk actors behind Play ransomware use a brand new technique to take advantage of CVE-2022-41082 that bypasses Microsoft’s mitigation measure for ProxyNotShell.The strategy entails the attacker exploiting one other — and little-known — SSRF bug in Trade server tracked as CVE-2022-41080 to entry the PowerShell distant service through the Outlook Internet Entry (OWA) entrance finish, as a substitute of the Autodiscover endpoint. Microsoft has assigned the bug the identical severity ranking (8.8) because it has for the SSRF bug within the unique ProxyNotShell exploit chain.CVE-2020-41080 permits attackers to entry the PowerShell distant service and use it to take advantage of CVE-2022-41082 in precisely the identical approach as they may when utilizing CVE-2022-41040, CrowdStrike mentioned. The safety vendor described the Play ransomware group’s new exploit chain as a “beforehand undocumented option to attain the PowerShell remoting service by the OWA frontend endpoint, as a substitute of leveraging the Autodiscover endpoint.”As a result of Microsoft’s ProxyNotShell mitigation solely blocks requests made to the Autodiscover endpoint on Microsoft Trade server, requests to entry the PowerShell distant service through the OWA entrance finish is not going to be blocked, the safety vendor defined. CrowdStrike has christened the brand new exploit chain involving CVE-2022-41080 and CVE-2022-41082 as “OWASSRF.”Patch Now or Disable OWA”Organizations ought to apply the Nov. 8, 2022, patches for Trade to stop exploitation for the reason that URL rewrite mitigations for ProxyNotShell will not be efficient towards this exploit technique,” CrowdStrike warned. “For those who can’t apply the KB5019758 patch instantly, it’s best to disable OWA till the patch will be utilized.”Microsoft didn’t reply instantly to a request for remark.CrowdStrike mentioned it found the brand new exploit chain when investigating a number of latest Play ransomware intrusions the place the preliminary entry vector was through a Microsoft Trade Server vulnerability. The researchers rapidly discovered that Play ransomware attackers had exploited the ProxyNotShell RCE vulnerability (CVE-2022-41082) to drop authentic payloads for sustaining entry and performing anti-forensics methods on compromised Microsoft Trade Servers. Nevertheless, there was no signal that that they had used CVE-2022-41040 as a part of the exploit chain. CrowdStrike’s additional investigation confirmed that the attackers had used CVE-2022-41080 as a substitute.The safety vendor’s suggestions to organizations for decreasing their publicity to the brand new risk consists of disabling distant PowerShell for nonadministrative customers the place doable and utilizing EDR instruments to detect Internet providers spawning PowerShell processes. The corporate has additionally offered a script that directors can use to observe Trade servers for indicators of exploitation.
[ad_2]