Microsoft Exchange Server ProxyNotShell CVE-2022-41040 / CVE-2022-41082 (SSRF plus authenticated RCE, exploited as zero-days, CISA KEV): which update fixes them and are old mitigations enough?

What it is: ProxyNotShell is a pair of Exchange Server flaws disclosed in late September 2022. CVE-2022-41040 is a server-side request forgery issue and CVE-2022-41082 allows remote code execution; CISA describes them as chainable, with the attacker needing valid (low-privilege) credentials. Microsoft marked them as exploited in the wild before a fix existed. CISA added both to the KEV catalog on 2022-09-30 with known ransomware use. Exchange Online customers do not need to take action. Am I affected: Microsoft's update guide lists on-premises Exchange Server 2013 CU23, 2016 CU22 and CU23, and 2019 CU11 and CU12 as affected (before the fix). Check your build with Get-ExchangeServer | Format-List Name,AdminDisplayVersion, or the version in EAC. Fix: 1. Install the November 2022 Exchange Security Update, KB5019758, on every Exchange server, and run it from an elevated prompt. Preferably go further and install the latest supported Cumulative Update plus the latest Security Update, because many later Exchange vulnerabilities have been fixed since. 2. The September 2022 URL-rewrite and PowerShell-remoting mitigations were only temporary; once patched, follow Microsoft's guidance to review whether to remove them, and do not rely on them in place of the update. 3. Make sure Exchange is not directly exposed more than needed: publish only required endpoints, put it behind a reverse proxy or VPN, and require MFA on user accounts so stolen credentials are less useful. 4. If an unpatched server was internet-facing, hunt for compromise: web shells in the Exchange front-end directories, unexpected files and scheduled tasks, suspicious w3wp.exe child processes, unexpected PowerShell remoting sessions, new mailbox rules or permissions, and IIS log requests to the Autodiscover/PowerShell endpoints from unknown sources. Microsoft's Exchange team and CISA publish detection guidance. Rebuild compromised servers from clean media, and rotate credentials for accounts that logged on to the server, service accounts and Exchange certificates. Verify: AdminDisplayVersion shows a build at or above the November 2022 Security Update level or newer on every server, and Microsoft's Exchange Health Checker script reports no missing updates. Sources: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41040 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41082 https://nvd.nist.gov/vuln/detail/CVE-2022-41040 https://www.cisa.gov/known-exploited-vulnerabilities-catalog