Proxynotshell

ProxyNotShell is a software vulnerability, specifically a flaw in the design or implementation of Microsoft Exchange Server. It was first identified and exploited through CVE-2022-41082, as reported by Palo Alto Networks' Unit 42. The ProxyNotShell exploit method leveraged an AutoDiscover endpoint to exploit another related vulnerability, CVE-2022-41040. These vulnerabilities were part of a series of security issues with Microsoft Exchange Server that have been problematic since 2021, including ProxyLogon and ProxyShell. However, a new exploit method known as OWASSRF has emerged, which bypasses mitigations previously provided by Microsoft for ProxyNotShell. Unlike ProxyNotShell, OWASSRF uses the OWA frontend endpoint to exploit yet another vulnerability, CVE-2022-41080. This development showcases the evolving capabilities of threat actors who continue to augment their toolbox with new tools and exploits, including ProxyNotShell, OWASSRF, and a remote code execution vulnerability in Microsoft Exchange Server. The Play group, a cyber threat actor, often gains initial access to victim networks by abusing valid accounts and exploiting public-facing applications. They have been known to exploit vulnerabilities in FortiOS (CVE-2018-13379 and CVE-2020-12812) and Microsoft Exchange (ProxyNotShell CVE-2022-41040 and CVE-2022-41082). Notably, the ProxyNotShell vulnerability cannot be easily patched, similar to other highly exploitable vulnerabilities like Log4j. Thus, it remains a significant concern in the cybersecurity landscape.