OWASSRF
- Product
- Microsoft Exchange Server 2013 / 2016 / 2019
- CVE
- CVE-2022-41080CVE-2022-41082
- Disclosed
- 2022-12-20
- CVSS
- 8.8
- Auth
- requires auth / interaction
- CISA KEV
- yes
- Affected
- On-premises Exchange Server before the November 2022 security updates
- Fixed
- November 8, 2022 Exchange security updates
Summary
CrowdStrike found Play ransomware operators bypassing Microsoft's ProxyNotShell URL Rewrite mitigations. Instead of Autodiscover, they reached the PowerShell backend through an SSRF in Outlook Web Access, then used the same CVE-2022-41082 deserialization bug.
Root cause
CVE-2022-41080 lets an authenticated request to an OWA path (e.g. /owa/<email>/powershell) be proxied to the remote PowerShell endpoint. Because the interim mitigations only matched autodiscover.json URLs, this route reached CVE-2022-41082 unchanged.
Impact
Authenticated RCE as SYSTEM on Exchange, used for ransomware deployment.
Detection
IIS / HTTPProxy logs with OWA requests to paths ending in /powershell (CrowdStrike's write-up shows /owa/mastermailbox%40outlook.com/powershell); w3wp.exe spawning PowerShell or remote-access tools.
Mitigation
Install the November 2022 or later Exchange updates; URL Rewrite rules alone are insufficient. Disable OWA if not needed.