Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Platform
Modern NDR
Resources
DETECTION OVERVIEW
Risk Factors
ProxyShell and ProxyNOTShell are a series of vulnerabilities, which include server-side request forgery (SSRF) and remote code execution (RCE) vulnerabilities. An unauthenticated attacker with network access to an unpatched Microsoft Exchange Server can exploit the SSRF vulnerability, CVE-2021-34473, or an authenticated attacker can exploit the SSRF vulnerability, CVE-2022-41040. By chaining one of these vulnerabilities with RCE vulnerabilities, an attacker can gain control of a device.
Kill Chain
Risk Score
84
Microsoft Exchange Server has vulnerabilities (CVE-2021-34473 and CVE-2022-41040) in how it validates URIs, enabling server-side request forgery (SSRF). The front-end services of the Exchange server accept client connections and act as a proxy, sending them to the appropriate back-end service. The attacker sends an HTTP request with a specially designed URI to the Autodiscover proxy service, which is routed to a targeted back-end service. As a result, an attacker can access service endpoints and exploit additional vulnerabilities in an attack chain to run code with SYSTEM privileges. The chained vulnerabilities are referred to as ProxyShell and ProxyNOTShell.
