⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-10-21.

CVE-2022-41082 — Deserialization of Untrusted Data in Microsoft Exchange Server 2013 Cumulative Update 23

CWE-502 — Deserialization of Untrusted Data29 documents18 sources
Severity
8.0HIGHNVD
VulnCheck8.8CISA8.8
EPSS
91.6%
top 0.32%
CISA KEV
KEVRansomware
Added 2022-09-30
Due 2022-10-21
Exploit
Exploited in wild
Active exploitation observed
Affected products
6
Microsoft Exchange Server 2013 Cumulative Update 23Microsoft Exchange Server 2016 Cumulative Update 22Microsoft Exchange Server 2016 Cumulative Update 23+3 more
Timeline
KEV addedSep 30
PublishedOct 3
KEV dueOct 21
Latest updateDec 29
CISA Required Action: Apply updates per vendor instructions.

Description

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.1 | Impact: 5.9

Affected Packages6 packages

Patches

Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-cg2v-9v73-ccwp: Microsoft Exchange Server Remote Code Execution Vulnerability↗2022-10-04
▶
CVEList
Microsoft Exchange Server Remote Code Execution Vulnerability↗2022-10-03
▶
VulnCheck
Microsoft Exchange Server Remote Code Execution Vulnerability↗2022
▶

💥Exploits & PoCs

1
Metasploit
Microsoft Exchange ProxyNotShell RCE↗
▶

🔍Detection Rules

2
Suricata
ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt - OWASSRF (CVE-2022-41040, CVE-2022-41082)↗2022-12-23
▶
Suricata
ET EXPLOIT Microsoft Exchange Remote Code Execution Attempt (CVE-2022-41040, CVE-2022-41082)↗2022-09-30
▶

📋Vendor Advisories

2
CISA
Microsoft Exchange Server Remote Code Execution Vulnerability↗2022-09-30
▶
Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability↗2022-09-13
▶

🕵️Threat Intelligence

14
Huntress
OWASSRF Explained: Analyzing the Microsoft Exchange RCE Vulnerability | Huntress↗2022-12-29
▶
Unit42
Threat Brief: OWASSRF Vulnerability Exploitation↗2022-12-23
▶
Unit42
Threat Brief: OWASSRF Vulnerability Exploitation↗2022-12-23
▶
Wiz
OWASSRF, a new exploit for Exchange vulnerabilities | Wiz Blog↗2022-12-22
▶
Wiz
OWASSRF, a new exploit for Exchange vulnerabilities | Wiz Blog↗2022-12-22
▶