Article Details
Scrape Timestamp (UTC): 2023-11-03 15:21:21.381
Original Article Text
Click to Toggle View
New Microsoft Exchange zero-days allow RCE, data theft attacks. Microsoft Exchange is impacted by four zero-day vulnerabilities that attackers can exploit remotely to execute arbitrary code or disclose sensitive information on affected installations. The zero-day vulnerabilities were disclosed by Trend Micro's Zero Day Initiative (ZDI) yesterday, who reported them to Microsoft on September 7th and 8th, 2023. Despite Microsoft acknowledging the reports, its security engineers decided the flaws weren't severe enough to guarantee immediate servicing, postponing the fixes for later. ZDI disagreed with this response and decided to publish the flaws under its own tracking IDs to warn Exchange admins about the security risks. A summary of the flaws can be found below: All these vulnerabilities require authentication for exploitation, which reduces their severity CVSS rating to between 7.1 and 7.5. Furthermore, requiring authentication is a mitigation factor and possibly why Microsoft did not prioritize the fixing of the bugs. It should be noted, though, that cybercriminals have many ways to obtain Exchange credentials, including brute-forcing weak passwords, performing phishing attacks, purchasing them, or acquiring them from info-stealer logs. That said, the above zero-days shouldn't be treated as unimportant, especially ZDI-23-1578 (RCE), which can result in complete system compromise. ZDI suggests that the only salient mitigation strategy is to restrict interaction with Exchange apps. However, this can be unacceptably disruptive for many businesses and organizations using the product. We also suggest implementing multi-factor authentication to prevent cybercriminals from accessing Exchange instances even when account credentials have been compromised. BleepingComputer has contacted Microsoft for a comment on ZDI's disclosure and is still waiting for a response.
Daily Brief Summary
Four zero-day vulnerabilities have been discovered in Microsoft Exchange, which may enable remote attackers to execute arbitrary code and disclose sensitive information on affected installations.
These flaws were reported to Microsoft on Sept 7th and 8th, 2023 by Trend Micro's Zero Day Initiative (ZDI).
Despite being informed about the flaws, Microsoft did not regard them as severe enough to necessitate immediate fixing, so the patches were deferred.
Conversely, ZDI disagreed with Microsoft's evaluation and published the flaws with its own tracking IDs in order to caution Exchange administrators about the security risks.
The exploitation of these vulnerabilities requires authentication, which could lessen their severity to a certain extent, and could be the reason why Microsoft did not rush to rectify these bugs.
It's important to note that cybercriminals have many methods to obtain Exchange credentials, which means these zero-days should not be considered unimportant. Specifically, ZDI-23-1578 that allows for RCE and could lead to complete system compromise.
ZDI suggests restricting interaction with Exchange apps as a primary mitigation strategy, while multi-factor authentication is another recommended method of preventing cybercriminal access to compromised Exchange accounts.