Quick Update (Monday Oct 3rd):

• Please note the links to guidance from Microsoft left by a reader in a comment to this post:

1) published a script to mitigate this vulnerability, an alternative to doing this via the admin GUI: https://microsoft.github.io/CSS-Exchange/Security/EOMTv2/ 

2) created mitigation that is automatically applied for customers using the Microsoft Exchange Emergency Mitigation service that was added in Sept 2021 Cumulative update; https://techcommunity.microsoft.com/t5/exchange-team-blog/new-security-feature-in-september-2021-cumulative-update-for/ba-p/2783155 

3) Published an analysis of attacks seen using these two exploits: https://www.microsoft.com/security/blog/2022/09/30/analyzing-attacks-using-the-exchange-vulnerabilities-cve-2022-41040-and-cve-2022-41082/.

• The workaround does not fully mitigate the vulnerablity. It appears that the filter is easy to bypass. See https://twitter.com/testanull/status/1576774007826718720

-----

In a blog post, Vietnamese security company GTSC noted that they saw evidence of a new "ProxyShell" like vulnerability being exploited in the wild. The evidence came from compromised Exchange servers GTSC observed when responding to incidents [1]. Later, Trend Micro confirmed that two vulnerabilities tracked by Trend Micro's zero-day initiative were involved in the compromise described by GTSC [2]. Trend Micro had reported the vulnerabilities to Microsoft about a month ago.

Microsoft has now published a blog post with its own guidance [3]

Microsoft identified two vulnerabilities as contributing to the recent incidents:

CVE-2022-41040: A Server Side Request Forgery (SSRF) issue. 
CVE-2022-41082: A remote code execution (RCE) issue.

The SSRF vulnerability can be used to trigger the RCE vulnerability. An attacker does need to be authenticated to exploit the SSRF vulnerability. 

No patch is available if you run Microsoft Exchange on premise, but you can use URL rewrite rules to prevent exploitation. Post exploitation, rules in Microsoft Sentinel and Microsoft Defender for Endpoint can be used to detect webshells and HTTP rewrite payloads installed by attackers.

There is no word as to a possible patch being released early. But the URL rewrite workaround should be sufficient for now. And please make sure all available patches are applied. Microsoft Exchange servers are a top target for attackers these days.

[1] https://www.gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html
[2] https://success.trendmicro.com/dcx/s/solution/000291651?language=en_US
[3] https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|