CVE-2022-41080

Microsoft Exchange Server Elevation of Privilege Vulnerability

Recent assessments:

zeroSteiner at January 10, 2023 3:53pm UTC reported:

This is an alternative method for bypassing Exchange Emergency Mitigation Service (EEMS) protections for the ProxyNotShell exploit chain. When this CVE is combined with CVE-2022-41082, they yield code execution as NT AUTHORITY\SYSTEM.

Installing the original patches from Microsoft that were released in November fix this exploit chain as well. The technique is arguably redundant when EEMS can be bypassed using various encoding techniques. This alternative vector is likely most valuable when used to avoid generating exploitation following the original pattern.

Assessed Attacker Value: 3
Assessed Attacker Value: 3Assessed Attacker Value: 3