Server-Side Request Forgery (SSRF) in Microsoft Exchange Server - CVE-2022-41040
Published: September 30, 2022 / Updated: January 11, 2023
Vulnerability identifier: #VU67770
CSH Severity: Critical
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:L/SI:N/SA:N/E:A/U:Red
CVE-ID: CVE-2022-41040
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vendor: Microsoft
Affected software:
Microsoft Exchange Server
Microsoft Exchange Server
Detailed vulnerability description
The disclosed vulnerability allows a remote user to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input within the Exchange OWA Autodiscover service.. A remote user can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker to execute arbitrary code on the target system.
Note, the vulnerability is being actively exploited in the wild.
How to mitigate CVE-2022-41040
Install update from vendor's website.
Sources
- https://gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
- https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41040
- https://www.zerodayinitiative.com/advisories/ZDI-22-1441/
- https://www.zerodayinitiative.com/advisories/ZDI-22-1595/