ProxyNotShell
- Product
- Microsoft Exchange Server 2013 / 2016 / 2019
- CVE
- CVE-2022-41040CVE-2022-41082
- Disclosed
- 2022-09-29
- CVSS
- 8.8
- Auth
- requires auth / interaction
- CISA KEV
- yes
- Affected
- On-premises Exchange Server 2013, 2016, 2019 before the November 2022 security updates
- Fixed
- November 8, 2022 Exchange security updates
Summary
A ProxyShell-like pair found exploited in the wild by GTSC in September 2022. It reuses the Autodiscover SSRF pattern to reach the PowerShell backend and then triggers a deserialization RCE. Unlike ProxyShell, the attacker needs any valid mailbox credentials, hence 'NotShell'.
Root cause
CVE-2022-41040 is an SSRF in the Autodiscover front end (a variant of the ProxyShell path confusion) that forwards authenticated requests to the remote PowerShell endpoint. CVE-2022-41082 is unsafe deserialization in the Exchange PowerShell backend, where crafted type information in PSRP data leads to instantiating attacker-chosen .NET types and code execution as SYSTEM.
Impact
Any authenticated low-privileged user can run code as SYSTEM on Exchange.
Detection
IIS logs matching autodiscover.json with '@' and 'Powershell' in the URL (Microsoft's interim URL Rewrite rule matched .*autodiscover\.json.*Powershell.*); unexpected child processes of w3wp.exe (MSExchangePowerShellAppPool). Nuclei template CVE-2022-41040.
Mitigation
Install the November 2022 or later Exchange security updates; disable remote PowerShell for non-admin users.