ProxyNotShell

The Exchange Mitigation EM1, which was published by Microsoft at the weekend, does not adequately seal the Exchange zero-day vulnerability ProxyNotShell (CVE-2022-41040) and can be easily bypassed. The problem is an "@" character in the Reg-Ex pattern, which makes the rule too precise. The Reg-Ex can thus be bypassed by making slight adjustments. This means that the rule is no longer ... Read more

This weekend, Microsoft rolled out the URL rewrite rule, which prevents the successful attack via ProxyNotShell, as an emergency mitigation rule. This means that all Exchange 2016 and Exchange 2019 servers should be equipped with the workaround. However, this only applies if Exchange is at a current patch level and the emergency mitigation feature is active. For Exchange 2013 ... Read more

The Exchange Server zero-day vulnerability became known today and is already being actively exploited. A corresponding defense measure exists and should be implemented as quickly as possible. You can find out how the defense measure is implemented here: Exchange Server zero-day vulnerability is being actively exploited On the website of the company GTSC details about the currently ongoing attack were given, for this ... Read more