ProxyNotShell: actively exploited, patched six weeks later
Exchange zero-days left unpatched for six weeks while mitigations kept getting bypassed
The market's verdict: +3.9% on MSFT in the week after.
What actually happened
On September 30, 2022, Microsoft disclosed two actively exploited Exchange Server zero days and shipped no patch, offering a URL rewrite mitigation that security researchers publicly bypassed, repeatedly, while attacks continued. Real fixes finally arrived on November 8, six weeks after disclosure, closing out an eighteen month sequence in which the same on premise mail servers were raided under three Proxy branded names. The company's mitigation strategy for its own flagship mail server was, briefly, a suggestion.
This one is officially acknowledged.
They did it more than once
Same servers, a new suffix, eighteen months later.
Links
-
Acknowledgement
- MSRC (Microsoft) (official)
-
Context
- The Register (publication)
↳ caused by CVE-2022-41040 / CVE-2022-41082 (ProxyNotShell)
Timeline
- Sep 30, 2022 Confirmed First reports came in.
- Nov 8, 2022 Fixed Permanent patches shipped on the November Patch Tuesday.