The US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert to warn admins to address actively exploited ProxyShell vulnerabilities on-premises Microsoft Exchange servers.
ProxyShell is the name of three vulnerabilities that could be chained by an unauthenticated remote attacker to gain code execution on Microsoft Exchange servers.
The three vulnerabilities used in ProxyShell attacks are:
The vulnerabilities are exploited remotely through Microsoft Exchange’s Client Access Service (CAS) running on port 443 in IIS.
The vulnerabilities were discovered by security Researcher Tsai orange from Devcore, the issues were awarded $ 200,000 during the April 2021 Pwn2Own hacking contest. On Thursday, Orange Tsai gave a talk at the Black Hat conference and shared details about the Microsoft Exchange vulnerabilities.
Tsai explained that the ProxyShell attack chain targets multiple components in the Microsoft Exchange, including the Autodiscover service which is used by client applications to configure itself with minimal user input.
“Malicious cyber actors are actively exploiting the following ProxyShell vulnerabilities: CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207,” reads the alert published by CISA. “An attacker exploiting these vulnerabilities could execute arbitrary code on a vulnerable machine. CISA strongly urges organizations to identify vulnerable systems on their networks and immediately apply Microsoft’s Security Update from May 2021—which remediates all three ProxyShell vulnerabilities—to protect against these attacks.”
The popular cybersecurity expert Kevin Beaumont was one of the first researcher to spot a threat actor that was attempting to target Microsoft Exchange installs.
Threat actors started actively scanning for the Microsoft Exchange ProxyShell remote code execution flaws after researchers released technical details at the Black Hat hacking conference.
Threat actors first compromise a Microsoft Exchange server, then exploit the flaws to drop web shells that could be used to install and execute other malicious payloads.
After exploiting an Exchange server, the threat actors dropped web shells that could be used to upload other programs and execute them.
Recently a new ransomware gang named LockFile was spotted targeting Microsoft Exchange servers using the recently disclosed ProxyShell vulnerabilities.
Security experts from Symantec reported that Lockfile gang first compromise the Microsoft Exchange servers then uses the PetitPotam vulnerability to take over a domain controller.
Researchers from security firm Huntress Labs discovered over 140 web shells deployed by attackers on more than 1,900 compromised Microsoft Exchange servers until last week.
Follow me on Twitter: @securityaffairs and Facebook
[adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, ProxyShell)
[adrotate banner=”5″]
[adrotate banner=”13″]
Healthcare service provider Kaiser Permanente disclosed a security breach that may impact 13.4 million individuals…
Over 1,400 CrushFTP internet-facing servers are vulnerable to attacks exploiting recently disclosed CVE-2024-4040 vulnerability. Over…
A ransomware attack on a Swedish logistics company Skanlog severely impacted the country's liquor supply. …
CISA adds Cisco ASA and FTD and CrushFTP VFS vulnerabilities to its Known Exploited Vulnerabilities…
U.S. CISA added the Windows Print Spooler flaw CVE-2022-38028 to its Known Exploited Vulnerabilities catalog.…
The U.S. Department of Justice (DoJ) announced the arrest of two co-founders of a cryptocurrency mixer…
This website uses cookies.