Pierluigi Paganini August 09, 2021

Threat actors are actively scanning for the Microsoft Exchange ProxyShell RCE flaws after technical details were released at the Black Hat conference.

Threat actors started actively scanning for the Microsoft Exchange ProxyShell remote code execution flaws after researchers released technical details at the Black Hat hacking conference.

ProxyShell is the name of three vulnerabilities that could be chained by an unauthenticated remote attacker to gain code execution on Microsoft Exchange servers.

The three vulnerabilities used in ProxyShell attacks are:

• CVE-2021-34473 – Pre-auth Path Confusion leads to ACL Bypass (Patched in April by KB5001779)
• CVE-2021-34523 – Elevation of Privilege on Exchange PowerShell Backend (Patched in April by KB5001779)
• CVE-2021-31207 – Post-auth Arbitrary-File-Write leads to RCE (Patched in May by KB5003435)

The vulnerabilities are exploited remotely through Microsoft Exchange’s Client Access Service (CAS) running on port 443 in IIS.

The vulnerabilities were discovered by security Researcher Tsai orange from Devcore, the issues were awarded $ 200,000 during the April 2021 Pwn2Own hacking contest. On Thursday, Orange Tsai gave a talk at the Black Hat conference and shared details about the Microsoft Exchange vulnerabilities.

Tsai explained that the ProxyShell attack chain targets multiple components in the Microsoft Exchange, including the Autodiscover service which is used by client applications to configure itself with minimal user input.

BleepingComputer highlighted that after Orange Tsai’s speech, security researchers PeterJson and Jang published a technical analsyis of the ProxyShell exploit.

“I and Jang recently successfully reproduced the ProxyShell Pwn2Own Exploit of Orange Tsai 🍊. Firstly, I just want to tell that I respect your hard work and the contribution of you to cybersecurity which inspired me many years ago. Now I want to summary the progress when we reproduce this Exploit chain as a write-up for our-self.” reads the analysis. “When ZDI release the advisories about these bug, I decided to analysis this chain for learning purpose. We can almost finished the chain before the BlackHat US talk’s of Orange and then we found an missing piece when Orange’s talk finished.”

The popular cybersecurity expert Kevin Beaumont was one of the first researcher to spot a threat actor that was attempting to target Microsoft Exchange installs.

Beaumont recommends to block 185.18.52.155 in order to stop this threat actor from probing Miscorsoft Exchange servers against the Autodiscover service.

The attackers were making the tuning of their exploit based on the details disclosed by Tsai.

The attackers divided a working request to detect a vulnerable system by triggering the compilation of the ASP.NET web application. 

The presence of the string “/autodiscover/autodiscover.json” or “/mapi/nspi/” strings in IIS logs could allow administrators to determine if they are under attack.

To prevent the attack, admins are recommended to install updates released by Microsoft.

Tsai told Bleeping computers that currently there are hundreds of thousands Microsoft Exchange servers exposed on the Internet.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Microsoft Exchange )

[adrotate banner=”5″]

[adrotate banner=”13″]