At the end of September 2022 the Vietnamese firm GTSC reported two zero-day vulnerabilities in Microsoft Exchange Server, tracked as CVE-2022-41040 and CVE-2022-41082 and named ProxyNotShell by the security community. The first is a server-side request forgery; the second permits remote code execution through PowerShell once authenticated access is obtained. Exchange Server 2013, 2016 and 2019 were affected. Patches followed on 11 October 2022.
In the interval, Microsoft published a mitigation based on blocking a URL pattern. Researchers demonstrated bypasses; the guidance was revised; further bypasses were demonstrated. A later technique reached the same flaws through the Outlook Web Access endpoint rather than Autodiscover.
A Pattern Rule Is A Description Of One Exploit
The repeated bypasses are not a story about Microsoft being careless. They are a story about what an interim mitigation can be. Blocking a URL pattern encodes the shape of the attack that has been seen, not the defect that permits it.
Anything that reaches the same code by a different path is unaffected, and finding another path is far cheaper than finding the original flaw. We filed the same distinction at 26-0714b, where hunting had to precede key rotation, and at 23-0518, where patching an appliance did not evict what was already inside. A mitigation buys time; it is not a smaller patch.
This Is The File Rackspace Was Blamed On
When Rackspace’s hosted Exchange environment fell in December 2022 — filed at 22-1202 — ProxyNotShell was widely assumed to be the cause. The forensic conclusion named a different vulnerability, CVE-2022-41080, reached by the OWA-endpoint technique.
So the reporting was wrong and it was nearly right, which is the least useful state for a defender. Anyone who checked whether they had applied the ProxyNotShell patches and stopped there had answered a question adjacent to the one that mattered. This desk keeps both files partly to record how that ambiguity actually behaved.
Exchange, Again
On-premises Exchange appears in this corpus year after year: here, at 22-1202, and in the SharePoint files at 25-0719 and 26-0714b that share its shape — an internet-facing Microsoft server product, exploited faster than its operators can patch it.
The durable observation is the one the desk records at 26-0714b: the advice that ends the pattern is not to run the thing on the public internet. That is a migration, not a patch, and it costs what a migration costs.
Built on vendor and researcher analyses. The GTSC report at end-September 2022, the two CVEs and their character, the affected Exchange versions, the 11 October 2022 patches, the successive mitigation bypasses, and the later OWA-endpoint technique are as documented. The connection to the Rackspace incident rests on Rackspace’s own statement identifying CVE-2022-41080; this file does not claim the two incidents share an actor beyond what is reported there. No proof-of-concept or indicator is reproduced. Graded high. Corrections: corrections@forensicpost.com.