Microsoft Exchange ProxyNotShell Remote Code Execution
Posted by deepcore on December 1, 2022 – 4:21 pm
This Metasploit module chains two vulnerabilities on Microsoft Exchange Server that, when combined, allow an authenticated attacker to interact with the Exchange Powershell backend (CVE-2022-41040), where a deserialization flaw can be leveraged to obtain code execution (CVE-2022-41082). This exploit only supports Exchange Server 2019. These vulnerabilities were patched in November 2022.
Post a reply
You must be logged in to post a comment.