CVE DatabaseCVE-2022-41040

Updated 2026-06-17한국어 권고문 →

CVE-2022-410408.8/HIGHCISA KEVCWE-918CWE-918

Microsoft Exchange Server Elevation of Privilege and SSRF Vulnerability (CVE-2022-41040, ProxyNotShell) Security Advisory

⚡ Jump to Patch

Affected Vendors

microsoft

Affected Components

exchange_server

Published Date

2022-10-03

CVSS v3.1

8.8

HIGH

EPSS (30d)

100.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Microsoft Exchange Server 2013, 2016, and 2019 On-Premises environments

Impact

Authenticated attackers can exploit this SSRF vulnerability to access backend APIs, leading to Remote Code Execution (RCE) and complete system compromise

Mitigation

Apply the official Microsoft cumulative security updates immediately, or implement IIS URL Rewrite rules as a temporary workaround

Affected Products & Version Scope

Microsoft Exchange Server 2013, 2016, and 2019 On-Premises (Exchange Online is not affected)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Refer to the Microsoft Security Update Guide to apply the latest Cumulative Update (CU) and Security Update (SU). Use the following PowerShell commands to verify your current Exchange Server build and apply the patch.

powershell

# Retrieve current Exchange Server version and build details
Get-ExchangeServer | Format-List Name, Edition, AdminDisplayVersion

# Restart IIS services after applying the official security patch
Restart-Service W3SVC, WAS -Force

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, configure the IIS URL Rewrite module to block malicious Autodiscover requests.

powershell

# Import WebAdministration module and define the block rule
Import-Module WebAdministration
$ruleName = 'Block-ProxyNotShell'

# Add a rewrite rule to block requests containing the ProxyNotShell pattern
Add-WebConfigurationProperty -PSPath 'IIS:\sites\Default Web Site' -Filter 'system.webServer/rewrite/rules' -Name '.' -Value @{name=$ruleName; patternSyntax='Regular Expressions'; stopProcessing='True'}
Set-WebConfigurationProperty -PSPath 'IIS:\sites\Default Web Site' -Filter "system.webServer/rewrite/rules/rule[@name='$ruleName']/match" -Name 'url' -Value '.*'
Add-WebConfigurationProperty -PSPath 'IIS:\sites\Default Web Site' -Filter "system.webServer/rewrite/rules/rule[@name='$ruleName']/conditions" -Name '.' -Value @{input='{REQUEST_URI}'; pattern='.*autodiscover\.json.*@.*Powershell'; ignoreCase='True'}
Set-WebConfigurationProperty -PSPath 'IIS:\sites\Default Web Site' -Filter "system.webServer/rewrite/rules/rule[@name='$ruleName']/action" -Name 'type' -Value 'CustomResponse'
Set-WebConfigurationProperty -PSPath 'IIS:\sites\Default Web Site' -Filter "system.webServer/rewrite/rules/rule[@name='$ruleName']/action" -Name 'statusCode' -Value 403

3. Log Audit & IoC Verification Commands

Scan IIS log files to detect potential exploitation attempts targeting the Autodiscover and PowerShell endpoints.

bash

# Search IIS logs for the ProxyNotShell exploitation pattern (Run in Linux/Bash or WSL)
grep -ri 'autodiscover.json' /var/log/iis/ | grep -i 'Powershell'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Due to active in-the-wild exploitation, immediately apply the official Microsoft security updates or implement the IIS URL Rewrite workaround.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2022-41040) is a Server-Side Request Forgery (SSRF, CWE-918) vulnerability residing in the Autodiscover service of Microsoft Exchange Server. When an attacker possesses valid standard user credentials (PR:L), they can craft malicious HTTP requests to bypass frontend access controls and route arbitrary requests to backend Exchange components. This is caused by insufficient input validation during the routing of requests from the frontend proxy to the backend APIs.

2. Exploitation Mechanics & Attack Scenario

Commonly referred to as 'ProxyNotShell', this attack chain combines CVE-2022-41040 (SSRF) with CVE-2022-41082 (RCE). An attacker targets the Autodiscover endpoint (e.g., /autodiscover/autodiscover.json) and injects specific URI patterns to access the backend Remote PowerShell endpoint. Once authenticated via SSRF, the attacker leverages the backend administrative session to execute arbitrary PowerShell commands, upload web shells, and establish persistent access.

3. Infrastructure & Business Impact

This vulnerability is listed in the CISA KEV catalog and has an EPSS score of 0.9996, indicating extremely high exploitation activity in the wild. Successful exploitation allows attackers to gain full administrative control over the internal mail server, leading to sensitive email exfiltration, Active Directory (AD) domain compromise, and potential ransomware deployment.

Official Vendor Advisories & References

NVD Original English Description

Microsoft Exchange Server Elevation of Privilege Vulnerability

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41040

Source: secure@microsoft.com · Patch, Vendor Advisory

http://packetstormsecurity.com/files/170066/Microsoft-Exchange-ProxyNotShell-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-41040

Source: af854a3a-2127-422b-91ae-364da2661108 · Mitigation, Patch, Vendor Advisory

https://www.kb.cert.org/vuls/id/915563

Source: af854a3a-2127-422b-91ae-364da2661108 · Third Party Advisory, US Government Resource

https://www.secpod.com/blog/microsoft-november-2022-patch-tuesday-patches-65-vulnerabilities-including-6-zero-days/

Source: af854a3a-2127-422b-91ae-364da2661108 · Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-41040

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2022-41040)

FAQ

Q1. How critical is CVE-2022-41040 and is it actively exploited in the wild?

CVE-2022-41040 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2022-41040?

Primary impacted vendors include microsoft across exchange_server. Scope summary: Microsoft Exchange Server 2013, 2016, and 2019 On-Premises (Exchange Online is not affected)

Q3. What temporary mitigations or workarounds exist for CVE-2022-41040 before patching?

[Mitigation] Apply the official Microsoft cumulative security updates immediately, or implement IIS URL Rewrite rules as a temporary workaround Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION