Tenable ブログ
ブログ通知を受信するProxyShell: 攻撃者は Microsoft Exchange Server における脆弱性(CVE-2021-34473)を突くためにスキャンしている
Three vulnerabilities from DEVCORE researcher Orange Tsai could be chained to achieve unauthenticated remote code execution. Attackers are searching for vulnerable instances to exploit.
Update August 23: The Analysis section has been updated with information about exploitation of this vulnerability chain. Organizations should update immediately.
背景
Last week at the Black Hat USA and DEF CON security conferences, DEVCORE researcher Orange Tsai presented a talk titled “ProxyLogon is Just the Tip of the Iceberg: A New Attack Surface on Microsoft Exchange Server!” In his Black Hat presentation, he walked through three vulnerabilities in Microsoft Exchange Server:
CVE | 説明/対策 | CVSSv3 | VPR* |
---|---|---|---|
CVE-2021-34473 | Microsoft Exchange Server Remote Code Execution Vulnerability | 9.1 | 9 |
CVE-2021-34523 | Microsoft Exchange Server Elevation of Privilege Vulnerability | 9.0 | 8.4 |
CVE-2021-31207 | Microsoft Exchange Server Security Feature Bypass Vulnerability | 6.6 | 8.4 |
出典:Tenable, August 2021
*Please note: Tenable’s Vulnerability Priority Rating (VPR) scores are calculated nightly. This blog post was published on August 9 and reflects VPR at that time.
Orange Tsai is a prolific researcher who has found many high-severity vulnerabilities in a wide range of products. Most relevant is CVE-2021-26855, aka ProxyLogon, which Tsai reported to Microsoft in January (Volexity and Microsoft Threat Intelligence Center also received credit for discovering this vulnerability). Despite this, ProxyLogon was exploited as a zero-day by the threat group HAFNIUM and other advanced persistent threat actors. Even after Microsoft issued an out-of-band patch for ProxyLogon, it continues to be exploited by threat actors for various types of attacks from cryptomining and creating botnets to ransomware.
分析
CVE-2021-34473 is a remote code execution vulnerability and the highest rated, receiving a CVSSv3 score of 9.1. CVE-2021-34523 and CVE-2021-31207 were both initially rated as “Exploitation Less Likely” according to Microsoft’s Exploitability Index because of their independent features, but when chained together, they have significant value to attackers. これらの脆弱性を連鎖させることにより、攻撃者はポート 443 の脆弱性のある Exchange Server で任意のコマンドを実行することができます。Two of the three ProxyShell vulnerabilities, CVE-2021-34473 and CVE-34523, were patched as part of the April 2021 Patch Tuesday release, though Microsoft says they were “inadvertently omitted” from that security update guide. CVE-2021-31207 は 5 月にパッチが適用されました。
Attackers are actively scanning for Exchange Servers vulnerable to ProxyShell
On August 6, security researcher Kevin Beaumont reported attempts to exploit this vulnerability chain in the wild.
My Exchange honeypot has somebody dropping files and executing commands. https://t.co/pMVsl7y4iy
— Kevin Beaumont (@GossiTheDog) August 6, 2021
Over the following days, several Computer Security Incident Response Teams issued alerts about attackers scanning for vulnerable Microsoft Exchange Servers. Because of how widely exploited the ProxyLogon and other Exchange Server vulnerabilities have been so far this year, we recommend organizations patch immediately. Attackers are already finding vulnerable servers to exploit and it may be prudent to initiate incident response procedures if you know you have unpatched servers on your network.
CISA urges organizations to patch servers
According to Symantec’s Threat Hunter Team and Huntress Labs, attackers continue to scan for and exploit vulnerable Microsoft Exchange servers using this attack chain to deploy the LockFile ransomware. Symantec also reports that the PetitPotam exploit is being used in these attacks to gain access to domain controllers and thereby spread the ransomware across target networks.
In response, the Cybersecurity and Infrastructure Security Agency issued an urgent alert urging organizations to identify and remediate vulnerable servers.
概念実証
After Tsai’s presentations last week, two other researchers published their reproduction of Tsai’s work which included more technical details on how to exploit the vulnerability chain. One of the researchers, Jang, also published a proof-of-concept for ProxyLogon earlier this year.
ベンダー応答
Microsoft は、4 月、 5 月の月例セキュリティ更新プログラムでこれらの脆弱性のすべてにパッチを適用しました。CVE-2021-34473 and CVE-2021-34523 were patched in April 2021 but Microsoft did not publish advisories until July.
影響を受けているシステムの特定
これらの脆弱性を識別する Tenable プラグインのリストは、こちらからご覧いただけます。
詳細情報
- Tenableブログ:Proxylogon などの Microsoft Exchange の脆弱性の探し方: Tenableがお手伝いできること
- Orange Tsai’s DEF CON Presentation
- PeterJson and Jang’s exploit reproduction on Medium
Tenable コミュニティの Tenable セキュリティレスポンスチームに参加してみませんか。
現代のアタックサーフェスを総合的に管理する Cyber Exposure Platform を初めて提供した Tenable について詳細情報をご覧ください。
今すぐ Tenable.io Vulnerability Management の 30 日間無料トライアルをお試しいただけます。
関連記事
- Vulnerability Management