The organization released an advisory late Wednesday letting clients know that threat actors may use unpatched Exchange servers \u201cto expand ransomware or conduct other post-exploitation activities\u201d and insisted they update instantly.<\/p>\n
\u201cOur advice, as always, is to install the most advanced CU and SU on all your Exchange servers to make sure that you are safe against the latest threats,\u201d the enterprise said. \u201cPlease update now!\u201d<\/p>\n
Clients that have updated the May 2021 security updates or the July 2021 security updates on their Exchange servers are shielded from these vulnerabilities, as is Exchange Online clients, so long as they make sure that all hybrid Exchange servers are updated, the organization wrote.<\/p>\n
\u201cBut if you failed to install one of these security updates, then your servers and vital information are vulnerable,\u201d as per the advisory.<\/p>\n
The ProxyShell intrudes that Devcore principal security researcher Orange Tsai described in a presentation at Black Hat. The three vulnerabilities enable an adversary to trigger remote code execution on Microsoft Exchange servers. Microsoft said the bugs stand a chance of exploitation in the following cases:<\/p>\n
\u2013The server is running an outdated, not assisted CU;<\/p>\n
\u2013The server is running security updates for outdated, unsupported versions of Exchange that were released in March 2021, or The server is running an outdated, unassisted CU, with the March 2021 EOMT mitigations applied.<\/p>\n
\u201cIn all of the above circumstances, you must install one of the latest assisted CUs and all applicable SUs to be preserved,\u201d according to Microsoft. \u201cAny Exchange servers not on a supported CU sand the latest available SU are exposed to ProxyShell and other attacks that grasp older vulnerabilities.\u201d<\/p>\n
Sounding the Alarm![\"ProxyShell\"](\"https:\/\/cmitsolutions.com\/tribeca-ny-1166\/wp-content\/uploads\/sites\/11\/2023\/02\/Simple-Work-Blog-Banner-1.jpg\")
<\/h2>\n
Following the SANS Internet Storm Center\u2019s Jan, Kopriva reported finding more than 30,000 vulnerable Exchange servers through a Shodan scan. Given how much data is available, any threat actor valued of that title would find exploiting then easy to execute.<\/p>\n
Security researchers at Huntress also complained seeing ProxyShell vulnerabilities being actively exploited throughout August to update backdoor access once the ProxyShell exploit code was released on Aug. 6. But commencing last Friday, Huntress reported a \u201csurge\u201d in attacks after discovering 140 web shells launched against 1,900 unpatched Exchange servers.<\/p>\n