Microsoft’s recent acknowledgment of an actively exploited critical security vulnerability in Exchange Server, tracked as CVE-2024-21410, has spurred rapid action in the cybersecurity community. This flaw, with a CVSS score of 9.8, poses a significant risk due to its potential for privilege escalation on affected servers.
The vulnerability allows attackers to target NTLM clients like Outlook, leaking credentials that can then be relayed against the Exchange server to gain unauthorized privileges and execute operations on behalf of the victim. This revelation comes hot on the heels of Microsoft’s Patch Tuesday updates, highlighting the urgency of addressing this issue.
The company’s latest bulletin not only acknowledges the exploit but also underscores the proactive steps taken to mitigate risks. With Extended Protection for Authentication (EPA) now enabled by default in Exchange Server 2019 Cumulative Update 14 (CU14), Microsoft aims to bolster defenses against such attacks.
While the specifics of the exploitation and the identity of threat actors remain undisclosed, historical patterns suggest potential involvement of groups like APT28 (Forest Blizzard). These actors have a track record of leveraging flaws in Microsoft Outlook for NTLM relay attacks, indicating a need for heightened vigilance within affected organizations.
CVE-2024-21410 is not an isolated incident. It joins the ranks of other recently patched vulnerabilities, such as CVE-2024-21351 and CVE-2024-21412, both actively exploited in real-world scenarios. The latter, CVE-2024-21412, facilitates the bypass of Windows SmartScreen protections and has been linked to the activities of Water Hydra (DarkCasino), an advanced persistent threat known for its sophisticated tactics.
In addition to Exchange Server vulnerabilities, Microsoft’s Patch Tuesday addresses CVE-2024-21413, a critical flaw affecting Outlook. This issue, codenamed MonikerLink, enables remote code execution by exploiting the incorrect parsing of “file://” hyperlinks, potentially leading to the leakage of local NTLM credentials and bypassing security measures like Protected View.
The widespread impact of these vulnerabilities underscores the importance of prompt patching and proactive security measures. Organizations are urged to prioritize updates and remain vigilant against emerging threats. With cybersecurity threats evolving rapidly, collaboration between industry stakeholders is crucial in safeguarding digital ecosystems against malicious actors.
Interesting Article : PikaBot: A New Dawn in Cybersecurity
Pingback: Turla Hackers Target Polish NGOs with TinyTurla-NG Backdoor