CVE-2022-41040

CVE-2022-41040 is a software vulnerability that was discovered in late September 2022, along with another flaw, CVE-2022-41082. These two zero-day vulnerabilities were collectively known as ProxyNotShell. The vulnerabilities were exploited to compromise Microsoft Exchange through the proxy mechanisms previously targeted during the ProxyLogon and ProxyShell campaigns in 2021. In this instance, an authenticated variation called ProxyNotShell was used, demonstrating a significant evolution of threat actor techniques. The Cortex XSOAR playbook, titled "CVE-2022-41040 & CVE-2022-41082 - ProxyNotShell," was updated to address these new threats. It incorporated additional hunting, remediation, and mitigation tasks to identify and respond to exploitation attempts effectively. This update represented a proactive approach to managing the risks associated with these vulnerabilities, providing organizations with the tools needed to detect and respond to potential attacks leveraging these flaws. However, despite these mitigation efforts, threat actors found ways to bypass ProxyNotShell mitigations. They used an alternative exploitation vector that abused another vulnerability, CVE-2022-41080, to achieve their objectives. As highlighted in the report, ransomware-affiliated actors were able to exploit this vulnerability, showing the persistent and evolving nature of these cyber threats. This underscores the need for continuous monitoring, updating, and refining of security measures to combat such dynamic threats.