VPNの脆弱性に関する不安が広がっています。ZPAの60日間無料トライアルを利用して、VPNからの移行のメリットをお確かめください。

Zscalerのブログ

Zscalerの最新ブログ情報を受信

購読する
セキュリティリサーチ

Coverage Advisory for Exploits Related to Microsoft Exchange Servers

JITHIN NAIR, ROHIT HEGDE
3月 03, 2021 - 4 分で読了

Update [19-Mar-2021]

Microsoft has released to GitHub the new Microsoft Exchange On-Premises Mitigation Tool and posted a blog with step-by-step instructions on how to use the tool. This is a free, one-click tool designed to help customers who have not yet applied the on-premises Exchange security update to temporarily protect their servers prior to patching. Microsoft has also issued a guidance for responders investigating and remediating these Exchange Server vulnerabilities.

There were also reports of threat actors installing a new ransomware called 'Dearcry' after hacking into Microsoft Exchange servers using the disclosed vulnerabilities.

Zscaler Coverage

Zscaler has added coverage for the Dearcry ransomware family and the web shells which were found deployed on these compromised servers using Advanced Threat Signatures and Advanced Cloud Sandbox.

  • Advanced Threat Protection
    Win32.Ransom.DearCry
    HTML.Webshell.Hafnium
    Win32.Backdoor.Hafnium
  • Advanced Cloud Sandbox
    Win32.Ransom.DearCry

[End of Update]

Background

Microsoft has reported multiple exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks. In the attacks observed, the threat actor used these vulnerabilities to access on-premises Exchange servers which enabled access to email accounts, and allowed installation of additional malware to facilitate long-term access to victim environments. Microsoft Threat Intelligence Center (MSTIC) has attributed this campaign to HAFNIUM, a group assessed to be state-sponsored and operating out of China, based on observed victimology, tactics and procedures.

What is the issue?

The following vulnerabilities were being exploited:

CVE-2021-26855: Server-side request forgery (SSRF) vulnerability in Exchange which allows the attacker to send arbitrary HTTP requests and authenticate as the Exchange server.

CVE-2021-26857: Insecure deserialization vulnerability in the Unified Messaging service. Insecure deserialization is where untrusted user-controllable data is de-serialized by a program. Exploiting this vulnerability gave attacker the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit.

CVE-2021-26858: Post-authentication arbitrary file write vulnerability in Exchange. If the attacker could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.

CVE-2021-27065: Post-authentication arbitrary file write vulnerability in Exchange. If the attacker could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.

After exploiting these vulnerabilities to gain initial access, HAFNIUM operators deployed web shells on the compromised server. Web shells potentially allow attackers to steal data and perform additional malicious actions that lead to further compromise.

What products are impacted?

  • Microsoft Exchange Server 2019
  • Microsoft Exchange Server 2016
  • Microsoft Exchange Server 2013

How can you identify if you have been compromised?

Detection guidance and Advanced hunting queries to help customers investigate this activity has been published by Microsoft here.

What can you do to protect yourself?

  • Ensure that your users always have the Zscaler Client Connector running to ensure coverage against these exploits.
  • We highly recommend ensuring you have the latest security updates installed for the products affected by these CVEs. 
  • Keep your security software up to date with the latest definitions.
  • Reduce the attack surface by limiting the visibility of these servers to the internet.

Zscaler coverage

The following signature detections are now in production for Zscaler customers:

  • Advanced Threat Protection
    HTML.Exploit.CVE-2021-26855
    Win32.Exploit.Nishang
    PS.Hacked.PowerCat
     
  • Advanced Cloud Sandbox
    Win32.Exploit.CVE-2021-26855
     
  • Advanced Cloud Firewall
    HTML.Exploit.CVE-2021-26855
    Win32.Trojan.ProcdumpExfil
    Win64.Trojan.ProcdumpExfil

Details related to these threat signatures can be found in the Zscaler Threat Library.

The Zscaler Cloud Sandbox will provide proactive coverage against weaponised payloads trying to exploit these vulnerabilities. The Zscaler ThreatLabZ team is also actively monitoring
and ensuring coverage for all the latest IOCs associated with these vulnerabilities targeting the Microsoft Exchange servers.

References

1. https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/

2. https://techcommunity.microsoft.com/t5/exchange-team-blog/released-march-2021-exchange-server-security-updates/ba-p/2175901

3. https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/

form submtited
お読みいただきありがとうございました

このブログは役に立ちましたか?

dots pattern

Zscalerの最新ブログ情報を受信

このフォームを送信することで、Zscalerのプライバシー ポリシーに同意したものとみなされます。