Microsoft Exchange CVE-2020-16875 Proof-of-Concept Code Released

THE THREAT

On September 10th, researcher Steven Seeley publicly released Proof-of-Concept (PoC) code for a critical remote code execution vulnerability he discovered affecting Microsoft Exchange Servers 2016 and 2019 (CVE-2020-16875). This vulnerability was originally announced by Microsoft on September 8th [1]. Successful exploitation would result in execution of arbitrary code in the context of the SYSTEM user, allowing an attacker to view, change, and delete data, or create new accounts on the impacted system.

In order to exploit this vulnerability, an attacker would require credentials belonging to accounts in a specific Exchange role. Although eSentire assesses that widespread exploitation of this vulnerability remains unlikely, affected organizations are advised to prioritize applying the relevant patches to remediate this threat as part of a defense in depth strategy.

What we’re doing about it

• MVS has a local plugin to identify this vulnerability

What you should do about it

• Test and apply recommended updates from Microsoft as soon as possible
• Audit users with “Data Loss Prevention" role assigned
• Restrict access to Exchange Control Panel from untrusted networks

Additional information

Steven Seeley (mr_me), the researcher who disclosed the vulnerability to Microsoft, authored two PoC exploits for the vulnerability. An advisory was posted on the srcincite.io website on September 10th, 2020, containing the PoCs and additional information on the vulnerability [2]. According to the advisory, the “flaw exists within the processing of the New-DlpPolicy cmdlet. The issue results from the lack of proper validation of user-supplied template data when creating a dlp policy”. Mr. Seeley also confirms that credentials belonging to a user with a specific Exchange role (DLP Role) are required to successfully exploit this vulnerability.

Requirements for exploitation for both PoC exploits:

PowerShell PoC Exploit

• Requires authentication
• Credentials must belong to account with “Data Loss Prevention" role assigned
• PowerShell Remoting possible to vulnerable Exchange server

Python PoC Exploit

• Requires authentication
• Credentials must belong to account with “Data Loss Prevention" role assigned
• Active mailbox for account
• Access to Exchange Control Panel (ECP)
  • According to Microsoft the ECP is not configured with an external URL by default [3]

Given the above conditions for successful exploitation, eSentire assesses that widespread exploitation of this vulnerability is unlikely. The vulnerability is more likely to be exploited post-compromise, as part of an ongoing intrusion where an attacker has obtained the necessary requirements for exploitation.

References:

[1] https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-16875

[2] https://srcincite.io/advisories/src-2020-0019/

[3] https://docs.microsoft.com/en-us/exchange/architecture/client-access/exchange-admin-center?view=exchserver-2019