CVE-2022-41082

CVE-2022-41082: Microsoft Exchange Server ProxyNotShell Remote Code Execution

AI-generated analysis based on the vulnerability data on this page.

Summary

CVE-2022-41082 is a remote code execution (RCE) vulnerability in Microsoft Exchange Server. It was disclosed alongside CVE-2022-41040 as part of the attack chain publicly dubbed ProxyNotShell. An authenticated attacker with access to the Exchange environment can exploit this flaw to execute arbitrary commands with SYSTEM-level privileges on the target server.

Background

In late September 2022, security researchers and incident responders observed in-the-wild exploitation of two zero-day vulnerabilities in on-premises Microsoft Exchange Server. The first, CVE-2022-41040, is a server-side request forgery (SSRF) vulnerability. The second, CVE-2022-41082, is the post-authentication RCE vulnerability detailed in this advisory. When chained together, an attacker can achieve unauthenticated remote code execution by first bypassing authentication via the SSRF, then leveraging the deserialization flaw to run arbitrary PowerShell commands.

Root Cause

The vulnerability stems from CWE-502: Deserialization of Untrusted Data. Specifically, the Exchange PowerShell remoting endpoint accepts and deserializes attacker-controlled data without adequate validation. By sending a specially crafted serialized object to the remote PowerShell endpoint (/powershell), an authenticated attacker can trigger unsafe deserialization, leading to arbitrary code execution in the context of the Exchange server process (running as SYSTEM).

The attack vector is adjacent network (AV:A), meaning the attacker must have network access to the Exchange server — typically from an internal network position or via a prior SSRF pivot such as CVE-2022-41040.

Impact

The CVSS v3.1 score of 8.0 (HIGH) reflects the severe confidentiality, integrity, and availability impact:

• Confidentiality: HIGH — Full access to all mailboxes and stored data.
• Integrity: HIGH — Ability to modify, delete, or forge emails and configuration.
• Availability: HIGH — Server can be taken offline or repurposed for further attacks.

The attacker requires low privileges (PR:L) and no user interaction (UI:N), making this highly exploitable once initial access is achieved.

With an EPSS score of 0.99964 and inclusion in both CISA's KEV catalog and the EU's exploited vulnerabilities database, this vulnerability is considered critically likely to be exploited and should be prioritized for immediate remediation.

Exploitation Walkthrough

⚠️ Ethics & Legal Notice: The following is a defensive, high-level description for understanding attack flow. No weaponized exploit code is provided. Unauthorized testing against systems you do not own is illegal.

1. Reconnaissance: The attacker identifies an on-premises Exchange Server instance reachable over the network.
2. Authentication Bypass (CVE-2022-41040): Using the SSRF flaw, the attacker crafts a request that tricks the Exchange server into authenticating to its own internal PowerShell remoting endpoint on the attacker's behalf.
3. Deserialization Payload Delivery: Through the authenticated PowerShell remoting session, the attacker sends a malicious serialized object.
4. Code Execution: The Exchange server deserializes the untrusted object, triggering the payload and executing arbitrary commands as SYSTEM.

From this point, the attacker may deploy webshells, exfiltrate mailboxes, establish persistence, or move laterally within the network.

Affected and Patched Versions

Affected:

• Microsoft Exchange Server 2013 — Cumulative Update 23
• Microsoft Exchange Server 2016 — Cumulative Update 22, Cumulative Update 23
• Microsoft Exchange Server 2019 — Cumulative Update 11, Cumulative Update 12

Patched: Microsoft released security updates in the November 2022 Patch Tuesday cycle. Administrators should apply the latest cumulative update for their Exchange version. Specific patch KB numbers are documented in the Microsoft Security Response Center advisory (see References).

Remediation

1. Apply Patches Immediately: Install the November 2022 (or later) cumulative security update for your Exchange Server version. This is the only complete fix.
2. Enable Microsoft-recommended URL Rewrite Mitigations: Until patching is possible, Microsoft published IIS URL Rewrite rules to block known ProxyNotShell exploitation patterns. These mitigations are temporary and not a substitute for patching.
3. Disable Remote PowerShell for Non-Admin Users: Restrict remote PowerShell access to only those accounts that explicitly require it.
4. Network Segmentation: Limit Exchange server exposure to the internet. Require VPN or WAF filtering for all external access.
5. EDR / Defender: Ensure Microsoft Defender for Endpoint or equivalent EDR is active on Exchange servers to detect post-exploitation activity.

Detection

• IIS Logs: Look for suspicious POST requests to /autodiscover/autodiscover.json (CVE-2022-41040) followed by POST to /powershell.
• PowerShell Remoting Logs: Monitor Windows Event ID 400 (PowerShell remoting session start) for anomalous source IPs or non-admin users.
• Process Spawning: Alert on w3wp.exe spawning unusual child processes (e.g., cmd.exe, powershell.exe).
• File System: Hunt for new or modified .aspx, .ashx, or .svc files in Exchange web directories — indicators of webshell deployment.
• Network: Suricata/Snort signatures and Microsoft Defender detections for ProxyNotShell activity are available via the references below.

Assessment

CVE-2022-41082 is not merely a theoretical RCE — it is a confirmed, actively exploited zero-day with near-certain exploit probability (EPSS ~99.96%). Its pairing with CVE-2022-41040 created a devastating attack chain that compromised numerous organizations before patches were available.

Key lessons:

1. Deserialization is a critical attack surface — Any endpoint that deserializes untrusted input must be treated as high-risk and rigorously audited.
2. Zero-day chains amplify risk — The SSRF-to-RCE combination demonstrates how seemingly "lower severity" bugs (e.g., SSRF) can enable catastrophic outcomes when adjacent flaws exist.

Organizations still running unpatched Exchange Server instances should treat this as a critical patching priority and simultaneously hunt for signs of prior compromise.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082
• http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41082
• https://www.kb.cert.org/vuls/id/915563
• https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/
• https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-detection-script
• https://www.vicarius.io/vsociety/posts/cve-2022-41082-microsoft-exchange-server-remote-code-execution-vulnerability-mitigation-script
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41082