Threat Signal Report

Vulnerable Microsoft Exchange Servers Actively Scanned for ProxyShell

Description

FortiGuard Labs is aware of a report that Microsoft Exchange servers are actively being scanned to determine which ones are prone to ProxyShell. ProxyShell is an exploit attack chain involving three Microsoft exchange vulnerabilities: CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207. When used in chain on a vulnerable Microsoft Exchange server, the attack allows the attacker to remotely run malicious code on the targeted system as a result. Microsoft patched all three vulnerabilities as part of Microsoft Patch Tuesday in April and May 2021.

When was the Issue Disclosed?

Security researcher Orange Tsai presented ProxyShell at the recent BlackHat, DefFon and the Pwn2Own contest.

Were CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207 Disclosed as Part of the ProxyShell presentation?

No, Microsoft disclosed CVE-2021-31207 in May and CVE-2021-34473 and CVE-2021-34523 in July as part of Patch Tuesday.

How Significant is ProxyShell?

MEDIUM-HIGH. While ProxyShell allows remote code execution on the compromised machine, patches are available for all three vulnerabilities, which lower the severity. According to security researcher Kevin Beaumont in relation to CVE-2021-34473, "about 50% of internet exposed boxes aren't patched yet," which somewhat raises severity.

What is the Workflow of ProxyShell?

In simple workflow, the attacker first exploits CVE-2021-34473 (Microsoft Exchange Server Remote Code Execution Vulnerability) on the vulnerable Microsoft Exchange server to gain Exchange backend access. Then CVE-2021-34523 (Microsoft Exchange Server Elevation of Privilege Vulnerability) is used to gain admin privilege, then CVE-2021-31207 (Microsoft Exchange Server Security Feature Bypass Vulnerability) is used to perform remote code execution.

Has Microsoft released a patch for the vulnerabilities?

Yes. Microsoft released a patch for CVE-2021-31207 in May.

While CVE-2021-34473 and CVE-2021-34523 were disclosed in July 2021, Microsoft released a patch in April 2021 without disclosing them.

Has any Malware been Deployed as a Result of the ProxyShell Exploit Attack Chain?

FortiGuard Labs is not aware of any malware being deployed to the affected servers. However, earlier in the year, DearCry ransomware was delivered to the machines that were compromised using another Microsoft Exchange server exploit chain "ProxyLogon". As such, ransomware payload off ProxyShell is always a possibility.

FortiGuard Labs is closely monitoring the situation and will update this Threat Signal when actual payload becomes available.

What is the Status of Coverage?

FortiGuard Labs provides the following IPS coverage against CVE-2021-34473:

MS.Exchange.Server.Autodiscover.Remote.Code.Execution

FortiEDR detects and blocks ProxyShell attacks out of the box without any prior knowledge or special configuration beforehand.

Currently, there is not enough information available for us to develop protection for CVE-2021-31207 and CVE-2021-34523. FortiGuard Labs is closely monitoring the situation and will update this Threat Signal when additional coverage becomes available.

Any Other Suggested Mitigation?

Disconnect vulnerable Exchange servers from the internet until a patch can be applied.

Due to the ease of disruption and potential for damage to daily operations, reputation, and unwanted release of personally identifiable information (PII), etc., it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed, and updated to protect against attackers establishing a foothold within a network.