Microsoft has pushed out emergency patches after Chinese-backed threat actors were spotted chaining four previously undisclosed critical vulnerabilities in Exchange Server/on-premises Outlook to attack targets including defence contractors, infectious disease researchers, law firms, think tanks, and other sectors.
The threat group has also used its intrusions to pivot to victim Office 365 tenants, with mixed success.
The attacks require no previous authentication (pre-auth) and give remote code execution (RCE). Security researchers at Virginia-based Volexity say the attacks appear to have started as early as January 6, 2021. They first spotted exploitation after seeing "a large amount of data being sent to IP addresses it believed were not tied to legitimate users" from two customers' Microsoft Exchange servers.
You can follow The Stack on LinkedIn here.
The incident response and digital forensics firm added: "The attacker was using the vulnerability to steal the full contents of several user mailboxes. This vulnerability is remotely exploitable and does not require authentication of any kind, nor does it require any special knowledge or access to a target environment. The attacker only needs to know the server running Exchange and the account from which they want to extract e-mail.
"In all cases of RCE, Volexity has observed the attacker writing webshells (ASPX files) to disk and conducting further operations to dump credentials, add user accounts, steal copies of the Active Directory database (NTDS.DIT), and move laterally to other systems and environments."
Microsoft said its threat intelligence center (MSTIC) "attributes this campaign with high confidence to HAFNIUM, a group assessed to be state-sponsored and operating out of China."
Microsoft has created a script to get a quick inventory of the patch-level status of on-premises Exchange servers. This can be downloaded from GitHub. Information on Indicators of Compromise (IOCs) can be found in HAFNIUM Targeting Exchange Servers. Urgent patching is recommended. Users should prepare for some downtime.
The four critical Exchange server vulnerabilities are as follows: CVE-2021-26855 is a server-side request forgery (SSRF) vulnerability in Exchange which allowed the attacker to send arbitrary HTTP requests and authenticate as the Exchange server. CVE-2021-26857 is an insecure deserialisation vulnerability in the Unified Messaging service. Exploitation by the threat group gives attackers the ability to run code as SYSTEM on the Exchange server. CVE-2021-26858 and CVE-2021-27065 are post-authentication arbitrary file write vulnerabilities.
Even users with legacy on-prem servers sitting behind ostensibly robust firewalls should patch, urgently. Microsoft notes that the emergency fixes can be installed only on the following server versions:
- Exchange Server 2010 (RU 31 for Service Pack 3)
- Exchange Server 2013 (CU 23)
- Exchange Server 2016 (CU 19, CU 18)
- Exchange Server 2019 (CU 8, CU 7)
"If your servers are running older Exchange Server cumulative or rollup update, you will need to install a currently supported RU/CU before you can install the security updates... Exploitation of the security vulnerabilities addressed in these fixes requires HTTPS access over the Internet. Therefore, our recommendation is to install the security updates first on Exchange servers exposed/published to the Internet (e.g., servers publishing Outlook on the web/OWA and ECP) and then update the rest of your environment."
Details from Volexity here.
Details from Microsoft here.
