Security advisories

Microsoft Exchange Server Elevation of Privilege Vulnerability

February 27, 2019 | 1 MIN READ

Speak With A Security Expert Now

TALK TO AN EXPERT

A new attack technique has been identified by security researcher Dirk-jan Mollema, which could allow an attacker to impersonate other Exchange users and elevate privileges [1].

Microsoft has released updated guidance on this issue which includes security updates to Exchange [2].

Proof-of-concept (PoC) code is available and is simple to use [3]. Customers are advised to test and deploy available security updates as soon as possible.

What we’re doing about it

What you should do about it

Additional information

The attack is conducted by using the Exchange Web Services' PushSubscription service to subscribe for push events, pointing them to the attacker’s machine. Exchange will connect to the attacker’s machine using the PushSubscriptionRequest method where it will attempt to authenticate using NTLM credentials (for the computer account of the Exchange server). These credentials are then relayed to a Domain Controller where the Exchange account can be used to elevate privileges for an account under the attacker’s control.

Unpatched Exchange 2013, 2016 and 2019 have been confirmed as vulnerable to this attack.

References:

[1] https://dirkjanm.io/abusing-exchange-one-api-call-away-from-domain-admin/

[2] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0686

[3] https://github.com/dirkjanm/PrivExchange

[4] https://blogs.technet.microsoft.com/exchange/2019/02/12/released-february-2019-quarterly-exchange-updates/

View Most Recent Advisories