One Article Review
| Source |  Fortinet ThreatSignal |
|---|---|
| Identifiant | 4209568 |
| Date de publication | 2022-02-27 20:17:01 (vue: 2022-03-01 19:05:26) |
| Titre | ProxyToken (CVE-2021-33766): Authentication Bypass in Microsoft Exchange Server |
| Texte | UPDATE 9/17 - An IPS signature has been released in definitions (18.160) as "MS.Exchange.Server.SecurityToken.Authentication.Bypass"FortiGuard Labs is aware of a new disclosure dubbed PROXYTOKEN, which is an authentication bypass in Microsoft Exchange server. The vulnerability was reported by security researcher Le Xuan Tuyen of the Zero Day Initiative (ZDI) in March 2021, and patched by Microsoft in the July 2021 release.Assigned CVE-2021-33766, this vulnerability allows an unauthenticated attacker to configure actions on mailboxes belonging to arbitrary users on the mail server. An example of this usage allows the threat actor to forward all emails addressed to an arbitrary user and forward them to an attacker controlled account.What are the Technical Details of this Vulnerability?Microsoft Exchange server creates two reference sites in IIS, one listening on port 80 HTTP and the other port 443 HTTPS. These pages are known as the Exchange Front End, and the Exchange Back End runs on port 81 HTTP and port 444 for HTTPS respectively. The front end is essentially a proxy to the back end. When forms require authentication, pages are served via /owa/auth/logon/aspx. Essentially, the issue lies when an Exchange specific feature called "Delegated Authentication" is deployed, the front end is unable to perform authentication on its own and passes each request directly to the back end and ultimately relies on the back end to determine if the incoming request is properly authenticated.Is there a Patch Available?Yes. Microsoft has released patches for this in the July 2021 release.What is the Status of Coverage?Customers running the latest definitions are protected by the following IPS signature:MS.Exchange.Server.SecurityToken.Authentication.BypassWhat Products are Affected?Microsoft Exchange Server 2019, 2016, 2013 are affected.Any Other Suggested Mitigation?Disconnect vulnerable Exchange servers from the internet until a patch can be applied.Due to the ease of disruption and potential for damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc., it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed, and updated to protect against attackers establishing a foothold within a network. |
| Envoyé | Oui |
| Condensat | /owa/auth/logon/aspx 160 2013 2016 2019 2021 33766 443 444 9/17 account actions actor addressed affected against all allows also any applied arbitrary are assigned attacker attackers authenticated authentication available aware back been belonging bypass bypasswhat called can configure controlled coverage creates customers cve daily damage date day definitions delegated deployed details determine directly disclosure disconnect disruption dubbed due each ease emails end ensure essentially establishing etc example exchange feature following foothold forms fortiguard forward from front has http https identifiable iis important incoming information initiative internet ips issue its july keep known labs latest lies listening mail mailboxes march microsoft mitigation network new one operations organization other own pages passes patch patched patches perform personally pii port potential products properly protect protected proxy proxytoken reference release released relies reported reputation request require researcher respectively running runs security securitytoken served server servers signature signature:ms signatures sites specific status suggested technical them these threat tuyen two ultimately unable unauthenticated until unwanted update updated usage user users vendor vulnerabilities vulnerability vulnerable what when which within xuan zdi zero |
| Tags | Vulnerability Threat |
| Stories | |
| Notes | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.