New Exploit Method Bypasses Official ProxyNotShell Mitigation

FortiGuard Labs is aware of reports that threat actors are using a combination of ProxyNotShell vulnerabilities (CVE-2022-41040 and CVE-2022-41082) in combination with Outlook Web Access (OWA) and a server side request forgery (SSRF) in a new exploit chain utilizing PowerShell to obtain a foothold and deliver malware (tools, Play ransomware) within a targeted environment ultimately for persistence. The new exploit vector is a Server Side Request Forgery (SSRF) attack on Outlook Web Access (OWA) which is being dubbed as OWASSRF. …

access aware cve cve-2022-41040 cve-2022-41082 exploit forgery labs malware mitigation official outlook owa play play ransomware powershell ransomware reports request server server side ssrf threat threat actors tools vulnerabilities web