Microsoft Exchange Server URI Validator CreateAttachmentFromUri server-side request forgery

Summaryinfo

A vulnerability classified as critical was found in Microsoft Exchange Server. The impacted element is the function CreateAttachmentFromUri of the component URI Validator. Executing a manipulation can lead to server-side request forgery. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Microsoft Exchange Server (Groupware Software) (version unknown). It has been declared as critical. This vulnerability affects the function CreateAttachmentFromUri of the component URI Validator. The manipulation with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality, integrity, and availability.

The weakness was released 11/07/2023 as ZDI-23-1581. The advisory is shared for download at zerodayinitiative.com. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 11/07/2023). A Microsoft spokesperson responded to BleepingComputer's request for a comment with the statement, that they've reviewed these reports and have found that they have either already been addressed, or do not meet the bar for immediate servicing under the severity classification guidelines and they will evaluate addressing them in future product versions and updates as appropriate.

Microsoft claims that the technique described requires an attacker to have prior access to email credentials, and no evidence was presented that it can be leveraged to gain elevation of privilege.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Additional details are provided at bleepingcomputer.com. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Groupware Software

Vendor

• Microsoft

Name

• Exchange Server

License

• commercial

Website

• Vendor: https://www.microsoft.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion