WARNING: Microsoft Exchange Under Attack With ProxyShell Flaws

The U.S. Cybersecurity and Infrastructure Security Agency is
warning of active exploitation attempts that leverage the latest
line of “ProxyShell” Microsoft Exchange vulnerabilities that
were patched earlier this May, including deploying LockFile
ransomware on compromised systems.

Tracked as CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207,
the vulnerabilities enable adversaries to bypass ACL controls,
elevate privileges on the Exchange PowerShell backend, effectively
permitting the attacker to perform unauthenticated, remote code
execution. While the former two were addressed by Microsoft on
April 13, a patch for CVE-2021-31207 was shipped as part of the
Windows maker’s May Patch Tuesday updates.

“An attacker exploiting these vulnerabilities could execute
arbitrary code on a vulnerable machine,” CISA said^[1].

The development comes a little over a week after cybersecurity
researchers sounded the alarm on opportunistic scanning and
exploitation^[2] of unpatched Exchange
servers by leveraging the ProxyShell attack chain.

Originally demonstrated at the Pwn2Own hacking contest^[3]
in April this year, ProxyShell is part of a broader trio of exploit
chains discovered by DEVCORE security researcher Orange Tsai that
includes ProxyLogon and ProxyOracle, the latter of which concerns
two remote code execution flaws that could be employed to recover a
user’s password in plaintext format.

“They’re backdooring boxes with webshells that drop other
webshells and also executables that periodically call out,”
researcher Kevin Beaumont noted^[4]
last week.

Now according to researchers from Huntress Labs, at least
five distinct styles of web
shells^[5] have been observed as
deployed to vulnerable Microsoft Exchange servers, with over over
100 incidents reported related to the exploit between August 17 and
18. Web shells grant the attackers remote access to the compromised
servers, but it isn’t clear exactly what the goals are or the
extent to which all the flaws were used.

More than 140 web shells have been detected across no fewer than
1,900 unpatched Exchanger servers to date, Huntress Labs CEO Kyle
Hanslovan tweeted^[6], adding “impacted
[organizations] thus far include building manufacturing, seafood
processors, industrial machinery, auto repair shops, a small
residential airport and more.”