Microsoft Exchange ProxyNotShell Remote Code Execution
Posted by deepcore on December 1, 2022 – 4:21 pm
Last Updated on December 1, 2022 by deepcore
This Metasploit module chains two vulnerabilities on Microsoft Exchange Server that, when combined, allow an authenticated attacker to interact with the Exchange Powershell backend (CVE-2022-41040), where a deserialization flaw can be leveraged to obtain code execution (CVE-2022-41082). This exploit only supports Exchange Server 2019. These vulnerabilities were patched in November 2022.
Post a reply
You must be logged in to post a comment.