Rewterz Threat Alert – Operation Exchange Marauder: Active Exploitation of Multiple Zero-Days

Severity

High

Analysis Summary

Active in-the-wild exploitation of multiple Microsoft Exchange vulnerabilities is seen, in an attempt to steal e-mail and compromise networks. In this campaign, a large amount of data was detected being sent to some IP addresses. A closer inspection of the IIS logs from the Exchange servers revealed rather alarming results. The logs showed inbound POST requests to valid files associated with images, JavaScript, cascading style sheets, and fonts used by Outlook Web Access (OWA). It was initially suspected the servers might be backdoored and that webshells were being executed through a malicious HTTP module or ISAPI filter. Investigation revealed that the servers were not backdoored and uncovered a zero-day exploit being used in the wild. 

The attacker was exploiting a zero-day server-side request forgery (SSRF) vulnerability in Microsoft Exchange (CVE-2021-26855). The attacker was using the vulnerability to steal the full contents of several user mailboxes. This vulnerability is remotely exploitable and does not require authentication of any kind, nor does it require any special knowledge or access to a target environment. The attacker only needs to know the server running Exchange and the account from which they want to extract e-mail.

This vulnerability has been confirmed to exist within the latest version of Exchange 2016 on a fully patched Windows Server 2016 server. The vulnerability exists in Exchange 2019 but has not been tested against a fully patched version, although it is believed that they are vulnerable. It should also be noted that this vulnerability does not appear to impact Office 365.

Following the discovery of CVE-2021-26855, The attacker had managed to chain the SSRF vulnerability with another that allows remote code execution (RCE) on the targeted Exchange servers. In all cases of RCE, the attacker was found writing webshells (ASPX files) to disk and conducting further operations to dump credentials, add user accounts, steal copies of the Active Directory database (NTDS.DIT), and move laterally to other systems and environments. The exploited vulnerabilities are as follows:

* CVE-2021-26855 is a server-side request forgery (SSRF) vulnerability in Exchange which allowed the attacker to send arbitrary HTTP requests and authenticate as the Exchange server.

* CVE-2021-26857 is an insecure deserialization vulnerability in the Unified Messaging service. Insecure deserialization is where untrusted user-controllable data is deserialized by a program. Exploiting this vulnerability gave HAFNIUM the ability to run code as SYSTEM on the Exchange server. This requires administrator permission or another vulnerability to exploit.

* CVE-2021-26858 is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.

* CVE-2021-27065 is a post-authentication arbitrary file write vulnerability in Exchange. If HAFNIUM could authenticate with the Exchange server then they could use this vulnerability to write a file to any path on the server. They could authenticate by exploiting the CVE-2021-26855 SSRF vulnerability or by compromising a legitimate admin’s credentials.

Impact

• Unauthorized Access
• Network Compromise
• Security Bypass
• Remote Code Execution

Indicators of Compromise

CVE

• CVE-2021-26855
• CVE-2021-26857
• CVE-2021-26858
• CVE-2021-27065

Filename

• web[.]aspx
• help[.]aspx
• document[.]aspx
• errorEE[.]aspx
• errorEEE[.]aspx
• errorEW[.]aspx
• errorFF[.]aspx
• healthcheck[.]aspx
• aspnet_www[.]aspx
• aspnet_client[.]aspx
• xx[.]aspx
• shell[.]aspx
• aspnet_iisstart[.]aspx
• one[.]aspx

MD5

• 1a7a85b0390b308b1801679e11567eac

SHA-256

• 406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928
• b75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0
• 097549cf7d0f76f0d99edf8b2d91c60977fd6a96e4b8c3c94b0b1733dc026d3e
• 2b6f1ebb2208e93ade4a6424555d6a8341fd6d9f60c25e44afe11008f5c1aad1
• 65149e036fff06026d80ac9ad4d156332822dc93142cf1a122b1841ec8de34b5
• 511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1
• 4edc7770464a14f54d17f36dc9d0fe854f68b346b27b35a6f5839adf1f13f8ea
• 811157f9c7003ba8d17b45eb3cf09bef2cecd2701cedb675274949296a6a183d
• 1631a90eb5395c4e19c7dbcbf611bbe6444ff312eb7937e286e4637cb9e72944

SHA1

• aea0999c6e5952ec04bf9ee717469250cddf8a6f

Source IP

• 167[.]99[.]168[.]251
• 5[.]254[.]43[.]18
• 91[.]192[.]103[.]43

Affected Products

• Microsoft Exchange Server 2013
• Microsoft Exchange Server 2016
• Microsoft Exchange Server 2019

Remediation

• Block the threat indicators at their respective controls.
• Search for IoCs in your environment.
• Update all vulnerable versions of Exchange Server.