UPDATE to September 30, 2022 FLASH UPDATE: Security researchers have revealed that updated mitigation techniques recently offered by Microsoft for an actively-exploited critical zero-day exploit-chain named “ProxyNotShell” are too specific and still leave many organizations with partial on-premise Exchange email environments vulnerable to compromise. The first vulnerability, tracked as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) which gives authenticated threat actors the ability to escalate their privilege on the server. The second vulnerability, tracked as CVE-2022-41082, is a remote code execution (RCE) vulnerability that allows an attacker to execute arbitrary code within the target infrastructure. In Microsoft’s original advisory, the company recommended that Exchange server administrators block remote PowerShell access for non-administrator users in the organization via a rule in the Internet Information Services (IIS) Manager. Due to the mitigations being limited to only blocking the URL patterns of known attacks, it still leaves hybrid Exchange environments vulnerable to attack. This exploit bypass was identified by cybersecurity researcher Jang, and he released a video of the bypass as proof-of-concept (PoC) and offered a broader blocking rule for Exchange administrators to use. Hybrid Exchange setups are “extremely common” in enterprise environments, and over 1,200 organizations expose their hybrid deployments to the public internet. After researchers were able to prove that the original mitigation technique could be bypassed, Microsoft released an update to their advisory, giving administrators three (3) mitigation options to prevent exploitation, based on the conditions of their Exchange environments. This attack-chain has yet to be patched, and the updated mitigation rules can be found in the Microsoft advisory linked below. CTIX analysts recommend that any administrators responsible for on-premise or hybrid deployments of Microsoft Exchange ensure they are implementing one (1) of the three (3) mitigations. Although the patch is still unpublished, the severe nature of the active exploits indicates that Microsoft will likely patch these flaws in the near future. Exchange server vulnerabilities are a massive target for cyber-espionage and extortion schemes, and the CTIX team will continue to provide actionable intelligence to our readers.