In honor of October Cybersecurity month our Greater Security team would like to give you some insides. Cybersecurity comes in many different forms and today we would like to talk about vulnerabilities. One of many challenges security professionals face is how to keep yourself up to date in all that happens in the world of cybersecurity. New found vulnerabilities are one of those items that you need to stay on top of as a professional.

First let’s start with a definition: “A vulnerability is a weakness in a system that allows a threat source to compromise its security”. (ICS2 – CISSP)

Microsoft Exchange Server – CVE-2022-41040 and CVE-2022-41082

Now we have a definition we can walk you through a recently found vulnerability, a weakness found in the Microsoft Exchange Server. Microsoft recently disclosed CVE-2022-41082 and CVE-2022-41040 related to Zero-day Vulnerabilities in Microsoft Exchange Server. The attack was found by security company GTSC and was first observed in early August when the attackers tried to use web-based backdoors to get easy access to the internet from any browser. Microsoft said it is working on the release of patches to fix the flaws permanently. In the meantime, Microsoft has recommended to mitigate the flaws. Let’s take a look at both these CVE’s, see what they are about and how to mitigate properly.

CVE-2022-41040

This CVE is a 0-day Server-Side Request Forgery vulnerability in Microsoft Exchange Servers. This exploitation can also allow an attacker to trigger CVE-2022-41082 remotely. The flaw has got the CVSS score 8.8 out of 10 (High).

So what is Server-Side Request Forgery?

Server-Side Request Forgery also known as SSRF is a security vulnerability that allows an attacker to induce the server-side application to make requests to an unintended location. The attacker might cause the server to make a connection to an internal service or they may be able to force the server to connect to arbitrary external systems, potentially leaking sensitive data.

CVE-2022-41082

This CVE is a Remote Code Execution(RCE) that can be exploited by an authenticated attacker remotely. It looks like ProxyShell, which was discovered last year. The CVSS score for this vulnerability is an 8.8 out of 10 (High).

So what is Remote Code Execution?

Remote Code Execution (RCE) is basically what it says, it is code being executed remotely. An attacker places malware or other malicious code on a computer or network and there is no user input needed and no physical access is needed. RCE attacks come in many different forms, but it is mostly used to dig deeper into an environment.

Back to the attack, here you see a visual overview of the attack: