SB2022093001 - Remote code execution in Microsoft Exchange Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022093001

SB2022093001 - Remote code execution in Microsoft Exchange Server

Published: September 30, 2022 Updated: January 14, 2023

Security Bulletin ID SB2022093001
Severity
Critical
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Critical 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Deserialization of Untrusted Data (CVE-ID: CVE-2022-41082)

The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to insecure input validation when processing serialized data. A remote user with access to PowerShell Remoting on vulnerable Exchange systems can pass specially crafted data to the application and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2022-41040)

The disclosed vulnerability allows a remote user to perform SSRF attacks.

The vulnerability exists due to insufficient validation of user-supplied input within the Exchange OWA  Autodiscover service.. A remote user can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.

Successful exploitation of this vulnerability may allow a remote attacker to execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.


Remediation

Install update from vendor's website.

References