Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert hunting, research and content.
Defend brute force attacks, active intrusions and unauthorized scans.
Protect assets from ransomware, trojans, rootkits and more.
Intelligence and visibility across AWS, O365, DevOps and more.
Configuration escalations, policy and posture management.
Detects malicious insider behavior leveraging Machine Learning models.
eSentire will be participating in the Avant Partner Summit.
Join eSentire and Telarus for a day of golfing.
Insurance firms, agencies and brokers are now a lucrative target for…
On August 30th, 2021, the Zero-Day Initiative released technical details for the Microsoft Exchange server vulnerability CVE-2021-33766 (CVSS: 7.3), alternatively known as ProxyToken. This release is expected to result in exploitation of the vulnerability by threat actors in the near future.
ProxyToken is tracked as an Information Disclosure vulnerability. Exploitation would allow a remote attacker to bypass authentication and make changes to an Exchange email server’s configuration. This may lead to the theft of sensitive information, including employee emails.
This vulnerability was patched in the July 2021 Exchange cumulative updates. Organizations are strongly recommended to ensure all Exchange servers are up to date on relevant security patches before exploitation occurs.
The ProxyToken vulnerability was announced in Microsoft’s July Patch Tuesday vulnerability release, and security patches have been available since April 2021. The vulnerability exists due to two issues in the Exchange code; a non-empty cookie (SecurityToken) in requests is not authenticated, and an HTTP 500 error exposes an Exchange control panel canary token.
In recent months, multiple significant vulnerabilities have been identified impacting Microsoft Exchange servers. The publication of technical details for these vulnerabilities has directly preceded attacks in the wild. As technical details are now available for ProxyToken, there is a high probability of real-world attacks occurring in the immediate future. Organizations are strongly encouraged to apply security patches as soon as possible.
For additional technical details on the vulnerability, see the full report from Zero Day Initiative.