Exchange 0-day-Exploit 2022

Exchange 0-day-Exploit 2022

by | Sep 30, 2022 | ALARM, ctx_adc, microsoft

CVE-2022-41040, CVE-2022-41082

Security Bulletin | High | 

Microsoft is investigating two reported zero-day vulnerabilities affecting Microsoft Exchange Server 2013, 2016, and 2019. The first vulnerability, identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, while the second, identified as CVE-2022-41082, allows remote code execution (RCE) when PowerShell is accessible to the attacker.  

What Customers Should Do

To protect your on-prem Exchange you can bind a responder policy on the Citrix ADC contentswitch handling all the Exchange related traffic:

add responder policy rspol_exchange_zeroday_oct_22 "HTTP.REQ.URL.PATH.SET_TEXT_MODE(IGNORECASE).STARTSWITH(\"/autodiscover\") && HTTP.REQ.URL.PATH_AND_QUERY.SET_TEXT_MODE(IGNORECASE).REGEX_MATCH(re/.*autodiscover\\.json.*\\@.*Powershell.*/)" RESET

Update 05.10.2022 (https://www.heise.de/news/Exchange-0-Day-Microsoft-korrigiert-Workaround-7284241.html):

add responder policy rspol_exchange_zeroday_oct_22 "HTTP.REQ.URL.PATH.SET_TEXT_MODE(IGNORECASE).STARTSWITH(\"/autodiscover\") && HTTP.REQ.URL.PATH_AND_QUERY.SET_TEXT_MODE(IGNORECASE).REGEX_MATCH(re/.*autodiscover\\.json.*.*Powershell.*/)" RESET

Bind this responder to the Exchange contentswitch.

Customers whose internal traffic flows directly to the Exchange servers should also implement the suggested mitigations described here: https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/

At the moment Citrix has not released any official WAF signatures.

In case you need help please open a ticket in your AXACOM Support Portal.

Exchange 0-day-Exploit 2022

Critical Citrix ADM (MAS) Security Bulletin for CVE-2022-27511 and CVE-2022-27512

by | Jun 14, 2022 | ALARM, ctx_adc

Description of Problem

Vulnerabilities have been discovered in Citrix Application Delivery Management (Citrix ADM) that, if exploited, could result in the following security issues: 

  • Corruption of the system by a remote, unauthenticated user. The impact of this can include the reset of the administrator password at the next device reboot, allowing an attacker with ssh access to connect with the default administrator credentials after the device has rebooted. 
  • Temporary disruption of the ADM license service. The impact of this includes preventing new licenses from being issued or renewed by Citrix ADM. 
CVE-ID  Description  CWE  Pre-conditions 
CVE-2022-27511 Corruption of the system by a remote, unauthenticated user potentially leading to the reset of the administrator password CWE-284: Improper Access Control Access to ADM IP 
CVE-2022-27512 Temporary disruption of the ADM license service  CWE-664: Improper Control of a Resource Through its Lifetime Access to ADM IP 

Da der ADM Zugangsdaten & Zugriff auf die konfigurierten Instanzen hat, wird empfohlen die Sicherheitslücke rasch zu schliessen in dem die ADM Instanz auf eine der folgenden Versionen aktualisiert wird:

  • Citrix ADM 13.1-21.53 and later versions of 13.1 
  • Citrix ADM 13.0-85.19 and later versions of 13.0 

Als Mitigation kann versucht werden die ADM Management IP über eine Firewall zu sperren.

Normalerweise ist das ADM nur von intern zugänglich wodurch das Risiko einer Ausnutzung der Schwachstelle relativ klein ist. Ein Angreifer müsste bereits Zugang zum internen Netz haben. Wie die Schwachstelle ausgenutzt werden kann ist bisher unbekannt.

Für detaillierte Informationen und weitere Schritte, folgen Sie bitte den Informationen im Original Citrix Artikel. Gerne unterstützen wir Sie bei bedarf bei dem Update.

Zum Original Artikel