Microsoft has confirmed reports of two zero-day vulnerabilities in Microsoft Exchange Server that have been exploited in the wild. Patches are not yet available.

CVE-2022-41040 and CVE-2022-41082: ProxyShell Variant Exploited in the Wild

Microsoft Exchange Server Remote Code Execution Vulnerability

The Microsoft Exchange Server installed on the remote host is missing a security update. It is, therefore, affected by multiple vulnerabilities as referenced in the Nov, 2022 security bulletin.

  - Microsoft Exchange Server Spoofing Vulnerability (CVE-2022-41078, CVE-2022-41079)

  - Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2022-41040, CVE-2022-41080,     CVE-2022-41123)

  - Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2022-41082)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Exchange Server installed on the remote host is potentially affected by multiple zero-day vulnerabilities, dubbed ProxyNotShell:

  - An unspecified authenticated server-side request forgery (SSRF) vulnerability. (CVE-2022-41040)

  - An unspecified authenticated remote code execution (RCE) vulnerability when PowerShell is accessible to the     attacker. (CVE-2022-41082)

Please refer to Microsoft for guidance on mitigations for these vulnerabilities.

This plugin detects the potential presence of a web shell in selected directories and this can be indicative that the host might have been exploited with CVE-2022-41040 / CVE-2022-41082. It is recommended that the results are manually verified and appropriate remediation actions taken.

Note that Nessus has not tested for this issue but has instead looked for files that could potentially indicate compromise.

ID	Name	Product	Family	Severity
167281	Security Updates for Microsoft Exchange Server (Nov 2022)	Nessus	Windows : Microsoft Bulletins	high
165705	Microsoft Exchange Server October 2022 Zero-day Vulnerabilities (ProxyNotShell)	Nessus	Windows : Microsoft Bulletins	high
165629	Potential exposure to Microsoft Exchange CVE-2022-41040 / CVE-2022-41082 Exploit	Nessus	Windows	high

Detections

Analytics

CVE-2022-41082

high

Tenable Plugins

high

high

high