One Article Review
| Source |  Fortinet ThreatSignal |
|---|---|
| Identifiant | 7284043 |
| Date de publication | 2022-10-02 22:04:17 (vue: 2022-10-03 06:07:34) |
| Titre | Vulnerable Microsoft Exchange Servers Actively Scanned for ProxyShell |
| Texte | FortiGuard Labs is aware of a report that Microsoft Exchange servers are actively being scanned to determine which ones are prone to ProxyShell. ProxyShell is an exploit attack chain involving three Microsoft exchange vulnerabilities: CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207. When used in chain on a vulnerable Microsoft Exchange server, the attack allows the attacker to remotely run malicious code on the targeted system as a result. Microsoft patched all three vulnerabilities as part of Microsoft Patch Tuesday in April and May 2021.When was the Issue Disclosed?Security researcher Orange Tsai presented ProxyShell at the recent BlackHat, DefFon and the Pwn2Own contest.Were CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207 Disclosed as Part of the ProxyShell presentation?No, Microsoft disclosed CVE-2021-31207 in May and CVE-2021-34473 and CVE-2021-34523 in July as part of Patch Tuesday.How Significant is ProxyShell?MEDIUM-HIGH. While ProxyShell allows remote code execution on the compromised machine, patches are available for all three vulnerabilities, which lower the severity. According to security researcher Kevin Beaumont in relation to CVE-2021-34473, "about 50% of internet exposed boxes aren't patched yet," which somewhat raises severity.What is the Workflow of ProxyShell?In simple workflow, the attacker first exploits CVE-2021-34473 (Microsoft Exchange Server Remote Code Execution Vulnerability) on the vulnerable Microsoft Exchange server to gain Exchange backend access. Then CVE-2021-34523 (Microsoft Exchange Server Elevation of Privilege Vulnerability) is used to gain admin privilege, then CVE-2021-31207 (Microsoft Exchange Server Security Feature Bypass Vulnerability) is used to perform remote code execution.Has Microsoft released a patch for the vulnerabilities?Yes. Microsoft released a patch for CVE-2021-31207 in May.While CVE-2021-34473 and CVE-2021-34523 were disclosed in July 2021, Microsoft released a patch in April 2021 without disclosing them.Has any Malware been Deployed as a Result of the ProxyShell Exploit Attack Chain?FortiGuard Labs is not aware of any malware being deployed to the affected servers. However, earlier in the year, DearCry ransomware was delivered to the machines that were compromised using another Microsoft Exchange server exploit chain "ProxyLogon". As such, ransomware payload off ProxyShell is always a possibility. FortiGuard Labs is closely monitoring the situation and will update this Threat Signal when actual payload becomes available.What is the Status of Coverage?FortiGuard Labs provides the following IPS coverage against CVE-2021-34473:MS.Exchange.Server.Autodiscover.Remote.Code.ExecutionFortiEDR detects and blocks ProxyShell attacks out of the box without any prior knowledge or special configuration beforehand. Currently, there is not enough information available for us to develop protection for CVE-2021-31207 and CVE-2021-34523. FortiGuard Labs is closely monitoring the situation and will update this Threat Signal when additional coverage becomes available.Any Other Suggested Mitigation?Disconnect vulnerable Exchange servers from the internet until a patch can be applied.Due to the ease of disruption and potential for damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc., it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed, and updated to protect against attackers establishing a foothold within a network. |
| Envoyé | Oui |
| Condensat | 2021 31207 34473 34473:ms 34523 about access according actively actual additional addressed admin affected against all allows also always another any applied april are aren attack attacker attackers attacks autodiscover available aware backend beaumont becomes been beforehand being blackhat blocks box boxes bypass can chain closely code compromised configuration contest coverage currently cve daily damage date dearcry deffon delivered deployed detects determine develop disclosed disclosing disconnect disruption due earlier ease elevation enough ensure establishing etc exchange execution executionfortiedr exploit exploits exposed feature first following foothold fortiguard from gain has high how however identifiable important information internet involving ips issue july keep kevin knowledge known labs lower machine machines malicious malware may medium microsoft mitigation monitoring network not off ones operations orange organization other out part patch patched patches payload perform personally pii possibility potential presentation presented prior privilege prone protect protection provides proxylogon proxyshell pwn2own raises ransomware recent relation release released remote remotely report reputation researcher result run scanned security server servers severity signal signatures significant simple situation somewhat special status such suggested system targeted them then threat three tsai tuesday until unwanted update updated used using vendor vulnerabilities vulnerabilities: vulnerability vulnerable what when which will within without workflow year yet |
| Tags | Threat Ransomware Malware |
| Stories | |
| Notes | |
| Move | 
|
L'article ne semble pas avoir été repris aprés sa publication.
L'article ne semble pas avoir été repris sur un précédent.