New attack campaign utilized a new 0-day RCE vulnerability on Microsoft Exchange Server

Update
[29-09-2022]: Micrsoft published a blog post detailing mitigation and detection steps regarding the new vulnerabilities: https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/
[03-10-2022]: After receiving information from Jang (@testanull), we noticed that the regex used in the Rewrite Rule could be bypassed. Exploit video PoC

https://gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html

NOT cool anymore

This has been the method of workarounds/patching by Microsoft for a while now. One need look no further back than the MSDT "patch". Instead of removing or fixing the underlying issue they have done things like this and removed specific exploitation rather than root cause issue. I know this was only a workaround, but this shouldn't be surprising anyone anymore.

Nice post

Nice read