Two high severity zero-day vulnerabilities for the Microsoft Exchange Server have been found to be exploited in the wild. An elevation of privilege vulnerability, and a remote code execution vulnerability have been used by attackers to gain access into victim’s systems. The Cybersecurity and Infrastructure Security Agency (CISA) recently added these two flaws to their known exploited vulnerabilities catalog, emphasising the risk of an exploit for these vulnerabilities remains high. Affected systems include on-premises Microsoft Exchange Server 2013, Exchange Server 2016, and Exchange Server 2019.  

CVE-2022-41040 is an elevation of privilege vulnerability that exists due to improper privilege management in Microsoft Exchange server. An authenticated attacker can exploit this vulnerability in a server side request forgery (SSRF) attack. This allows the attacker to remotely trigger CVE-2022-41082, a remote code execution vulnerability. Through an exploit of this second zero-day, attackers can remotely run arbitrary code in PowerShell in the server’s account through a network call.  

Proof-of-concept code is available for exploitation of both of these vulnerabilities. No user interaction is need for either attack, however the attacker must be an authenticated user in both cases. The attack analysis on Microsoft’s blog also confirms that these vulnerabilities can be exploited separately, CVE-2022-41082 does not have to be triggered by CVE-2022-41040. Microsoft also released a guidance report for users to deal with these vulnerabilities, which states that Exchange Online customers do not need to take any further remediation steps as they will be applied automatically. 

Mitigation steps are provided by Microsoft to block the known attack patterns by adding a blocking rule in IIS Manager -> Default Web Site -> URL Rewrite -> Actions. The URL Rewrite mitigation steps script can then be applied. A blocking rule using the pattern .*autodiscover\.json.*\@.*Powershell.* can also be used to break current attack chains. Additional advice is to disable remote PowerShell access for all non-admin users. Currently these mitigation steps are the only solution possible as Microsoft are yet to release any updates to patch these two vulnerabilities.