New Microsoft Exchange Server Zero-Day Vulnerabilities

Blog

Politics and Policy Keynotes: Nord Stream 1 & 2 Pipeline Destruction Overshadows Moscow Granting Citizenship to Former NSA Contractor Edward Snowden

In late September, Danish armed forces discovered leaks from undersea pipes in the Baltic Sea. (3) These leaks were caused by the suspected sabotage of the Russian (Gazprom) owned Nord Stream 1 and Nord Stream 2 pipelines. It is still not clear as to who may have sabotaged these pipelines, or if it even was sabotage, but the Kremlin was quick to suggest that the United States had the most to gain from the supposed destruction of property by increasing their prices of liquified natural gas (LNG). (8) Both Ukraine and Poland are pointing their fingers at the Kremlin, (1) but Moscow has and is still denying these accusations. (4) The Nord Stream pipelines inadvertently became pawns in the conflict between Russia and Ukraine; since June, Russia has significantly reduced the amount of gas transported through Nord Stream 1 and shut it down in late August due to “problems with equipment”. Analysts suggest this was a result of the imposed sanctions from the West on Russia. (7)

Also occurring on the 26th of September, Moscow granted Russian citizenship to former National Security Agency (NSA) U.S. contractor Edward Snowden. Snowden is facing espionage charges in the U.S. after exposing classified NSA files pertaining to numerous domestic and global surveillance programs without proper authorization. (17) It is unclear as to why Snowden has been granted Russian citizenship, but it could be argued that this is an act to further escalate tensions between the West and Russia, or also possible, an attempt to make this controversial move at a time that it is less likely to gain widespread publicity. In 2017 Putin said that Snowden, “who keeps a low profile while living in Russia, was wrong to leak U.S. secrets, but should not be considered a traitor.” (20) Russia’s drastic reduction in gas supplies over the last few months, its ongoing actions in Ukraine, and the deliberate choice to provide a haven to a known U.S. adversary, mean that the opportunity to jump-start de-escalatory negotiations is becoming more difficult.

Malware: New Microsoft Exchange Server Zero-Day Vulnerabilities

Vietnam-based security researchers at cybersecurity firm GTSC discovered two zero-day vulnerabilities which targeted Microsoft Exchange servers and can be tracked as CVE-2022-41040 (server-side request forgery (SSRF)) and CVE-2022-41082 (remote code execution if the attacker has access to PowerShell). (14) The details, shared publicly last week by GTSC, were confirmed by Microsoft. (13) GTSC suspects the Chinese threat group perpetrators were chaining the pair of zero-day vulnerabilities to deploy Chinese Chopper web shells on any compromised servers for persistence and data theft, as well as moving laterally to other systems on the compromised network. The high severity of these vulnerabilities is caused by the possibility of remote code execution (RCE) on the compromised system(s). (12)

The stages this exploit works in are:

Receiving requests with a similar format to the ProxyShell vulnerability: autodiscover/autodiscover.json?@evil.com/<Exchange-backend-endpoint>&Email=autodiscover/autodiscover.json%3f@evil.com.
The use of the link above to access a component in the backend where the RCE could be implemented. (12)

The link to ‘evil[.]com’ is a reference to Evil Corp, an international, but primarily Russian cybercrime network that makes use of malicious software to steal funds from their victims. Known victims include Garmin, as well as banks, charities, and schools. The US Department of Justice has dubbed them “cyber-enabled bank robbers” because of the millions (>$100m) of dollars they have stolen. (15, 16)

Also confirmed by Microsoft, GTSC has provided successful temporary mitigations to block these attacks until Microsoft releases a security update addressing these two zero-day vulnerabilities. (12)

Adding a new IIS server rule by way of the URL Rewrite Rule module:

In Autodiscover at FrontEnd, select tab URL Rewrite, and then Request Blocking.
Add string “.*autodiscover\.json.*\@.*Powershell.*“ to the URL Path.
Condition input: Choose {REQUEST_URI}

GTSC recommends that all organizations and/or enterprises that currently use Microsoft Exchange servers check, review, and apply the above temporary mitigation to avoid the potentially considerable damage that could arise if the exploit is successful. (11) It is also possible for administrators that want to verify the integrity of their Exchange servers to run the following PowerShell command to scan IIS log files for any indicators of compromise (IoC’s):

Get-ChildItem -Recurse -Path <Path_IIS_Logs> -Filter “*.log” | Select-String -Pattern ‘powershell.*autodiscover\.json.*\@.*200’

About EclecticIQ Intelligence & Research Team

EclecticIQ is a global provider of threat intelligence, hunting, and response technology and services. Headquartered in Amsterdam, the EclecticIQ Intelligence & Research Team is made up of experts from Europe and the U.S. with decades of experience in cyber security and intelligence in industry and government.

We would love to hear from you. Please send us your feedback by emailing us at research@eclecticiq.com or fill in the EclecticIQ Audience Interest Survey to drive our research towards your priority area.

Structured Data

Find the Analyst Prompt and earlier editions in our public TAXII collection for easy use in your security stack.

TAXII v1 Discovery services: https://cti.eclecticiq.com/taxii/discovery

Please refer to our support page for guidance on how to access the feeds.

You might also be interested in:

Network Environment-Focused Conversations Needed in Approaches to Cyber Security

Emotet Downloader Document Uses Regsvr32 for Execution

AI Facial Recognition Used in Ukraine/Russia War Prone to Vulnerabilities