نقص جدید Microsoft Exchange به نام ProxyToken به مهاجمان اجازه می‌دهد تا صندوق‌های پستی را دوباره پیکربندی کنند

??????? ?? ???? ?????????? ?????? ???? (ProxyToken) ???? ??? ??? Microsoft Exchange Server ????? ??? ??? ?? ???????? ???? ?????? ???? ????? ???? ??????????? ???? ???? ?? ???????? ???? ?? ????? ???? ???????? ???? ?? ????? ??????? ????? ???? (PII) ??????.

??? ??? ?? ??? CVE-2021-33766 (?????? CVSS: 7.3) ? ?? ??? ?????? “ProxyToken”? ????Le Xuan Tuyen ?? ???? ???? ????? ??????? ???? ??? ? ??????? ?????? (VNPT-ISC) ???? ??? ?? ? ?? ???? ?????? Zero-Initiative (ZDI) ?? ???? ???? ????? ??[?] [?].

ZDI ??? ?????? ?? ??? ???? ?????????? ???[?] [?]: “?? ??? ??????????? ?? ????? ???? ????? ???? ???????? ??????? ???????? ?? ??? ????????? ???? ????? ?? ??????? ?????? ????? ???. ???????? ????? ?? ?????? ??????? ?? ?? ???? ??? ???? ???? ????????? ???? ?? ?? ??? ? ???? ? ????? ????? ?? ????? ?? ???? ????? ????? ??????? ??????? ???.”

?????????? ???????? ???? ?? ??????????? ??????????? ??? ?? ??? ??? ???? ????? ???? ??? ???? ?? ????? ???[?] [?].

??? ????? ?????? ?? ???????? ?? ??? ????? ????? ????? ??? ???? ???? ?? ?? ???????? ????? ???? ?? ??????? ?? ??????? ????-?????? Outlook web access (OWA)-????????? ???? ?? ???? SecurityToken ?? ????? ??????? ??????????? ????? ???? ?? ???????? ?? back-end ????? ??????.

?????????? ???????? Exchange ???? ?????? ??? ???????? ??? ?? ?? ??? ????? ??????? ??? ? ????? ?? ?? back-end ????? ???? ???? ?? ???????? ?????? ?? ?? ?? ????? ?????? ??????? ??? ????? (“DelegatedAuthModule”) ?? ??????? ??????? ??????? ??????? ? ????????? back-end ?? ????? ???? ??????????? ????? ?? ???? ???? SecurityToken ???? ???????? ???? ?? ??? ??? ?? ??????.

????? ???????? ?? ZDI ????? ???: “????? ????? ??? ??? ?? ?????????? ????????? ???? ???? ?? ????? ???? ?? ???? front ?? back ?? ??? ?????.”

??? ??????? ?? ???? ?????????? ?? ?????????????? Exchange Server ?? ????? ???? ??? ???? ????? ?????? ?????? ProxyLogon ? ProxyOracle ? ProxyShell ?? ?????? ???? ???? ??????? ???? ?? ?????? ????? ??????? ???? ????[?] [?-?]? ??????? ????????? ???? ?? ? ??? ?????? ???????? ???? ????? LockFile ??????? ??????[?] [?].

?? ??? ??????????????? ?? ???? ??? ????[?] [?]? ???? ?????? ?? NCC Group? ???? ???? ??????????? ?? ??? ??????? ?? ProxyToken ?? ????? ?? ??? ??? ??? ???? ???????? ????? ??? ?? ??????? ?????? ???? ????? ??????????????? ??????? ?????????? ????? ????.

?????

[?] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-33766

[?] https://www.zerodayinitiative.com/blog/2021/8/30/proxytoken-an-authentication-bypass-in-microsoft-exchange-server

[?] https://thehackernews.com/2021/07/update-your-windows-pcs-to-patch-117.html

[?] https://apa.aut.ac.ir/?p=7863

[?] https://apa.aut.ac.ir/?p=8196

[?] https://apa.aut.ac.ir/?p=8229

[?] https://apa.aut.ac.ir/?p=8244

[?] https://twitter.com/buffaloverflow/status/1432364885804036097

[?] https://thehackernews.com/2021/08/new-microsoft-exchange-proxytoken-flaw.html

پویش #دو_درجه_کمتر