Microsoft Exchange Server up to 2019 CU7 information disclosure

Summaryinfo

A vulnerability was found in Microsoft Exchange Server 2013 CU23/2016 CU17/2016 CU18/2019 CU6/2019 CU7. It has been classified as critical. Affected by this issue is some unknown functionality. This manipulation causes information disclosure. The identification of this vulnerability is CVE-2020-16969. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability classified as critical was found in Microsoft Exchange Server 2013 CU23/2016 CU17/2016 CU18/2019 CU6/2019 CU7 (Groupware Software). Affected by this vulnerability is an unknown code block. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

<p>An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user.</p> <p>To exploit the vulnerability, an attacker could include specially crafted OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other types of tracking systems.</p> <p>The security update corrects the way that Exchange handles these token validations.</p>

The weakness was shared 10/13/2020 as confirmed security guidance (Website). It is possible to read the advisory at portal.msrc.microsoft.com. This vulnerability is known as CVE-2020-16969. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK. The advisory points out:

An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user. To exploit the vulnerability, an attacker could include specially crafted OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other types of tracking systems. The security update corrects the way that Exchange handles these token validations.

It is declared as proof-of-concept.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Groupware Software

Vendor

• Microsoft

Name

• Exchange Server

Version

• 2013 CU23
• 2016 CU17
• 2016 CU18
• 2019 CU6
• 2019 CU7

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion