Microsoft Exchange ProxyNotShell Zero-Day — Critical Alert for Admins

CVE-2022-41040 and CVE-2022-41082 — dubbed ProxyNotShell — are two chained vulnerabilities in Microsoft Exchange Server allowing authenticated attackers to execute arbitrary code remotely.

Affected Versions

• Microsoft Exchange Server 2013
• Microsoft Exchange Server 2016
• Microsoft Exchange Server 2019
• Exchange Online NOT affected

Immediate Mitigation

# PowerShell — apply URL rewrite rule
# Run on Exchange server as Administrator

Add-WebConfigurationRule -Filter "system.webServer/rewrite/rules" `
  -PSPath "IIS:\Sites\Default Web Site\Autodiscover" `
  -InputObject @{
    name = "Block ProxyNotShell";
    patternSyntax = "Regular Expressions";
    match = @{url = ".*autodiscover\.json.*\@.*Powershell.*"};
    action = @{type = "AbortRequest"}
  }

Apply the Official Patch

# Download November 2022 Cumulative Update from Microsoft
# https://techcommunity.microsoft.com/exchange

# Verify patch level
Get-ExchangeDiagnosticInfo -Server $env:COMPUTERNAME -Process EdgeTransport -Component MailboxTransport

Indicators of Compromise

# Check IIS logs for exploitation attempts
Get-Content "C:\inetpub\logs\LogFiles\W3SVC1\*.log" | 
  Select-String "autodiscover.json" | 
  Select-String "powershell"

Why Linux Mail Servers Are Safer

This vulnerability only affects Microsoft Exchange. Linux-based mail servers (Postfix, Dovecot, Mailcow) are not affected — another reason many organisations are migrating away from Exchange.

Conclusion

Exchange zero-days are increasingly common. Our team provides emergency server support for Exchange and Linux mail server incidents.