Microsoft Exchange Server Elevation of Privilege Vulnerability

A new attack technique has been identified by security researcher Dirk-jan Mollema, which could allow an attacker to impersonate other Exchange users and elevate privileges [1].

Microsoft has released updated guidance on this issue which includes security updates to Exchange [2].

Proof-of-concept (PoC) code is available and is simple to use [3]. Customers are advised to test and deploy available security updates as soon as possible.

What we’re doing about it

• esRECON plugins will be updated to detect CVE-2019-0686 in Windows products

What you should do about it

• Assess and deploy relevant Security Updates from Microsoft (released on February 12, 2019) [2].

• Microsoft’s previously suggested workarounds negatively impacted EWS clients such as Outlook for Mac or Skype for Business. Microsoft has stated the following regarding potential impact with the latest security updates:

• “We have evaluated the changes to push notifications against many commonly used EWS clients, e.g. Outlook Mac, Skype for Business Client, native iOS mail clients and observed no loss of functionality due to these changes” [4].

• If applying the security updates is not currently a viable option, Microsoft’s alternative mitigation via Throttling Policy can also be implemented, but potential impacts should be understood.

Additional information

The attack is conducted by using the Exchange Web Services' PushSubscription service to subscribe for push events, pointing them to the attacker’s machine. Exchange will connect to the attacker’s machine using the PushSubscriptionRequest method where it will attempt to authenticate using NTLM credentials (for the computer account of the Exchange server). These credentials are then relayed to a Domain Controller where the Exchange account can be used to elevate privileges for an account under the attacker’s control.

Unpatched Exchange 2013, 2016 and 2019 have been confirmed as vulnerable to this attack.

References:

[1] https://dirkjanm.io/abusing-exchange-one-api-call-away-from-domain-admin/

[2] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0686

[3] https://github.com/dirkjanm/PrivExchange

[4] https://blogs.technet.microsoft.com/exchange/2019/02/12/released-february-2019-quarterly-exchange-updates/