Loading vulnerability…
CVE-2022-41082 is a remote code execution vulnerability in on-premises Microsoft Exchange Server that affects Exchange Server 2013, 2016, and 2019. It is most commonly exploited as part of the ProxyNotShell chain with CVE-2022-41040, an authenticated server-side request forgery issue that can be used to reach the Exchange PowerShell remoting endpoint. Available reporting indicates that once an attacker can access Exchange PowerShell remoting, CVE-2022-41082 can be triggered to achieve arbitrary code execution on the Exchange server. Multiple references characterize the flaw as involving insecure deserialization in the Exchange PowerShell execution path. The issue was actively exploited in the wild prior to patch release and was used by both ransomware operators and espionage actors to obtain code execution on vulnerable Exchange infrastructure.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
4 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (4 hidden).
This repository contains a single Metasploit module: 'exchange_proxynotshell_rce.rb', which exploits the ProxyNotShell vulnerabilities (CVE-2022-41040 and CVE-2022-41082) in Microsoft Exchange Server 2019. The exploit chains an SSRF (Server-Side Request Forgery) and a deserialization flaw to achieve remote code execution on the target Exchange server. The attacker must have valid credentials to authenticate. The module supports two payload types: direct command execution and Windows executable dropper. The exploit interacts with Exchange's HTTP endpoints, specifically '/mapi/nspi/' for version checking and '/Autodiscover/autodiscover.json' for the SSRF and PowerShell backend access. The code is operational and leverages Metasploit's payload system, allowing for customizable payloads. The repository is structured as a typical Metasploit exploit module, with all logic contained in a single Ruby file.
This repository is a proof-of-concept exploit for CVE-2022-41082 (OWASSRF), targeting Microsoft Exchange servers. It consists of three files: a README.md with detailed usage and background, a Python exploit script (poc.py), and a requirements.txt listing dependencies. The main exploit script, poc.py, automates the process of authenticating to the Exchange OWA endpoint, starting a local RPC server, and leveraging the OWASSRF vulnerability to execute arbitrary PowerShell commands on the target server. The attacker provides a command file containing the payload, which is base64-encoded and injected into the PowerShell session. The exploit can be used for a variety of post-exploitation actions, including establishing a reverse shell. The script requires valid credentials for a user with Remote PowerShell access and targets the Exchange server over HTTPS endpoints. The repository is structured as a standalone PoC and does not belong to a larger exploit framework.
This repository provides a working exploit for two Microsoft Exchange vulnerabilities: CVE-2022-41082 (ProxyNotShell/OWASSRF, post-auth RCE) and CVE-2022-41076 (TabShell, privilege escalation via PowerShell sandbox escape). The main exploit is implemented in 'poc.py', a Python script that authenticates to the Exchange OWA endpoint using provided credentials, sets up a local HTTP server to relay PowerShell requests, and abuses the Exchange PowerShell endpoint to execute arbitrary commands on the server. The command to execute is read from a file (default: 'cmd'), which can be set to any desired payload (e.g., launching calc.exe). The exploit leverages the PowerShell Remoting Protocol (PSRP) via a bundled 'pypsrp' library. The included 'TabShell.ps1' PowerShell script is used for privilege escalation after initial access, allowing the attacker to break out of the restricted PowerShell sandbox. The repository is well-structured, with clear separation between the exploit logic, supporting library code, and payload scripts. It targets unpatched Exchange 2013, 2016, and 2019 servers as of November 2022, and requires valid credentials for exploitation. The attack vector is network-based, targeting the Exchange OWA and PowerShell endpoints over HTTP(S).
This repository provides a working exploit for two Microsoft Exchange vulnerabilities: CVE-2022-41082 (ProxyNotShell/OWASSRF, a post-auth RCE) and CVE-2022-41076 (TabShell, a privilege escalation via PowerShell sandbox escape). The main exploit logic is in 'poc.py', which authenticates to the Exchange OWA endpoint using provided credentials, then abuses the PowerShell endpoint to execute arbitrary commands. The exploit sets up a local HTTP server to relay requests and uses the included 'pypsrp' library for PowerShell Remoting Protocol (PSRP) communication. The payload is customizable and can be any PowerShell command, with examples provided (calc.exe, mspaint.exe, ipconfig.exe). The 'TabShell.ps1' script demonstrates privilege escalation by breaking out of the restricted PowerShell sandbox after initial access is gained. The repository is structured with a main PoC script, a PowerShell privilege escalation script, a command file for payloads, and a full implementation of the pypsrp library for PSRP communication. The exploit is operational and can be used to achieve RCE and privilege escalation on vulnerable, unpatched Exchange servers with valid credentials.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
41 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A previously known Exchange vulnerability mentioned only as background comparison for insecure deserialization risks.
A known publicly exploitable vulnerability affecting Microsoft Exchange Server that attackers were observed scanning and exploiting in the StrikeShark campaign.
A Microsoft Exchange Server vulnerability, also known as ProxyNotShell, listed as weaponized by the threat actor.
A Microsoft Exchange Server vulnerability listed among those targeted for initial access.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.