CISA recommends immediately patch Exchange ProxyShell flaws

US CISA issued an urgent alert to warn admins to address ProxyShell vulnerabilities on-premises Microsoft Exchange servers.

The US Cybersecurity and Infrastructure Security Agency (CISA) issued an alert to warn admins to address actively exploited ProxyShell vulnerabilities on-premises Microsoft Exchange servers.

ProxyShell is the name of three vulnerabilities that could be chained by an unauthenticated remote attacker to gain code execution on Microsoft Exchange servers.

The three vulnerabilities used in ProxyShell attacks are:

CVE-2021-34473 – Pre-auth Path Confusion leads to ACL Bypass (Patched in April by KB5001779)CVE-2021-34523 – Elevation of Privilege on Exchange PowerShell Backend (Patched in April by KB5001779)CVE-2021-31207 – Post-auth Arbitrary-File-Write leads to RCE (Patched in May by KB5003435)

The vulnerabilities are exploited remotely through Microsoft Exchange’s Client Access Service (CAS) running on port 443 in IIS.

The vulnerabilities were discovered by security Researcher Tsai orange from Devcore, the issues were awarded $ 200,000 during the April 2021 Pwn2Own hacking contest. On Thursday, Orange Tsai gave a talk at the Black Hat conference and shared details about the Microsoft Exchange vulnerabilities.

Tsai explained that the ProxyShell attack chain targets multiple components in the Microsoft Exchange, including the Autodiscover service which is used by client applications to configure itself with minimal user input.

“Malicious cyber actors are actively exploiting the following ProxyShell vulnerabilities: CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207,” reads the alert published by CISA. “An attacker exploiting these vulnerabilities could execute arbitrary code on a vulnerable machine. CISA strongly urges organizations to identify vulnerable systems on their networks and immediately apply Microsoft’s Security Update from May 2021—which remediates all three ProxyShell vulnerabilities—to protect against these attacks.”

The popular cybersecurity expert Kevin Beaumont was one of the first researcher to spot a threat actor that was attempting to target Microsoft Exchange installs.

Threat actors started actively scanning for the Microsoft Exchange ProxyShell remote code execution flaws after researchers released technical details at the Black Hat hacking conference.

Threat actors first compromise a Microsoft Exchange server, then exploit the flaws to drop web shells that could be used to install and execute other malicious payloads.

After exploiting an Exchange server, the threat actors dropped web shells that could be used to upload other programs and execute them.

Recently a new ransomware gang named LockFile was spotted targeting Microsoft Exchange servers using the recently disclosed ProxyShell vulnerabilities. 

Security experts from Symantec reported that Lockfile gang first compromise the Microsoft Exchange servers then uses the PetitPotam vulnerability to take over a domain controller.

Researchers from security firm Huntress Labs discovered over 140 web shells deployed by attackers on more than 1,900 compromised Microsoft Exchange servers until last week.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, ProxyShell)