CVE-2020-0688 - Exchange Control Panel Viewstate Deserialization Bug

Attacker Value

Very High

CVE-2020-0688 - Exchange Control Panel Viewstate Deserialization Bug

Description

A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka ‘Microsoft Exchange Memory Corruption Vulnerability’.

Add Assessment

zeroSteiner (345)

February 26, 2020 5:02pm UTC (4 years ago)•

Ratings

Attacker Value

High

Exploitability

High

Common in enterprise Easy to weaponize Gives privileged access Vulnerable in default configuration

Technical Analysis

This is a serialization bug in the Exchange Control Panel component of the Microsoft Exchange server. The write up by ZDI outlines an exploitation path in grate detail how the vulnerability would be leveraged to gain command execution as NT_AUTHORITY\SYSTEM on the server.

The root of the issue is that the validationKey is not randomized at installation time, resulting in Exchange servers using an attacker known value. This value can be used to submit crafted data to the server that passes validation checks and is ultimately deserialized which can result in code execution.

The important values from the write up are:

validationkey = CB2721ABDAF8E9DC516D621D8B8BF13A2C9E8689A25303BF
validationalg = SHA1

I anticipate that the largest barrier to developing a PoC for this will be setting up and configuring a target environment. Exploiting this vulnerability requires authenticating as a user. The user must be a member of the Domain Users group and have a configured mailbox in Exchange.

The ViewState must be transferred within a GET request, POST can not be used. This introduces size restrictions on the OS command that can be executed.

See More &1 replySee Less

hartescout (19) February 26, 2020 6:48pm UTC (4 years ago)•Edited 4 years ago

I’ll be using your TA format the next time I post an analysis. Appreciate the example.

hartescout (19)

February 26, 2020 2:30am UTC (4 years ago)•Edited 4 years ago

Ratings

Attacker Value

Very High

Exploitability

High

Common in enterprise Difficult to patch Easy to weaponize Gives privileged access

Technical Analysis

This one is fairly new. I will put a few quotes in here as they display my ideas of why this should be considered high priority and have better writing skills than I do, unfortunately.
I was initially alerted (again) to this CVE with the Thread linked here : https://twitter.com/GossiTheDog/status/1232368620270911488
I agree, enterprise environments with Internet facing Exchange. As stated in the thread, you can see a simple search with shodan.io will expose this vulnerability. There are thousands that qualify.

Here is another, more formal and thorough analysis I think you will find helpful: https://www.thezdi.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys

Here is a video of bug in action.
https://youtu.be/7d_HoQ0LVy8

This is a RCE vulnerability that effects Microsoft Exchange Server. Now a patch was released, but Microsoft has not classified this as critical, so we will see how effective it is.

“Instead of having randomly-generated keys on a per-installation basis, all installations of Microsoft Exchange Server have the same validationKey and decryptionKey values in web.config. These keys are used to provide security for ViewState. ViewState is server-side data that ASP.NET web applications store in serialized format on the client. The client provides this data back to the server via the __VIEWSTATE request parameter. “

I welcome any discussion, please tell me if I missing something. I would love to hear more about this and if any Blue Team has had an incident already.
Take care!

See More &3 repliesSee Less

kevthehermit (138) February 26, 2020 8:49am UTC (4 years ago)•Edited 4 years ago

I am still reviewing this in my lab environment, however you marked this as difficult to patch. From the zdi writeup I assume just changing the keys is enough to mitigate

hartescout (19) February 26, 2020 11:04am UTC (4 years ago)•Edited 4 years ago

If that’s the case then I should not have marked the patching as difficult. I need to look into this more tomorrow if possible. Thanks for the heads up, please let us know what you find!

tcammcom (0) February 28, 2020 3:26pm UTC (4 years ago)

Has anyone had a chance to confirm if changing the key is an effective mitigation? The Microsoft CVE said there are no mitigations, but like Kev mentioned, the write up said it was a requirement for exploit .

J3rryBl4nks (83)

March 02, 2020 10:11pm UTC (4 years ago)•Edited 4 years ago

Ratings

Attacker Value

Very High

Exploitability

High

Common in enterprise Easy to weaponize Gives privileged access Vulnerable in default configuration

Technical Analysis

Due to widespread credential stuffing and password spraying attacks, the fact that this is a deserialization RCE due to hard coded encryption keys, the exploit is universally portable.

There are also POC scripts that just require you to get valid credentials.

See More &3 repliesSee Less

dabdine-r7 (10) March 03, 2020 3:02pm UTC (4 years ago)

Do you have links to those POCs?

J3rryBl4nks (83) March 03, 2020 4:54pm UTC (4 years ago)•Edited 4 years ago

https://www.thezdi.com/blog/2020/2/24/cve-2020-0688-remote-code-execution-on-microsoft-exchange-server-through-fixed-cryptographic-keys

This has the exploit POC generation as a part of the blog. Using yososerial.net they generate a command that you can copy/paste and just change the payload.

cinzinga (18) March 04, 2020 1:13pm UTC (4 years ago)•Edited 4 years ago

Metasploit module is now available, increasing the ‘exploitability’ of this exploit substantially.

https://github.com/rapid7/metasploit-framework/pull/13014

theguly (51)

February 28, 2020 4:45pm UTC (4 years ago)•Edited 4 years ago

Ratings

Attacker Value

Very High

Exploitability

Very High

Easy to weaponize

Technical Analysis

just to add the exploit and proper tag
https://github.com/Ridter/cve-2020-0688

xFreed0m (16)

March 10, 2020 2:34pm UTC (4 years ago)•Edited 4 years ago

Ratings

Attacker Value

Very High

Exploitability

High

Common in enterprise Easy to weaponize Gives privileged access Vulnerable in default configuration Authenticated

Technical Analysis

the easiness of exploiting this vulnerability depends directly on the ability to get a working set of creds.
that means that if the organization has weak password policy, guessable passwords, leaked credentials or external interface that allows password spraying, obtaining such credentials will be easy for adversaries.

See More &2 repliesSee Less

J3rryBl4nks (83) March 10, 2020 3:59pm UTC (4 years ago)•Edited 4 years ago

I agree. The proliferation of OWA spraying tools makes me think that there are a lot of attackers that are going after this vulnerability right now.

xFreed0m (16) March 10, 2020 4:02pm UTC (4 years ago)•Edited 4 years ago

yup, its easy to get bulletproof hosting, run endless password spraying attacks against OWA\Office365 until you get creds, and then with this vuln it’s game over as Exchange in a core server that will almost always would yield DA creds.

todb-r7 (23)

April 09, 2020 2:08pm UTC (4 years ago)•Edited 4 years ago

Ratings

Attacker Value

Very High

Exploitability

High

Common in enterprise Difficult to patch Easy to weaponize Gives privileged access Vulnerable in default configuration Authenticated

Technical Analysis

Just to drop in my panicky two cents: Exchange Administrators are historically hesitant to patch Exchange without extensive planning and often physical presence to reboot / restore if needed. Exchange patching isn’t usually just a matter of patch, reboot, move on with your life — many sites need to deprovision an Exchange server to fail over, then again to do it the other way. Even when everything goes well, sometimes the patch doesn’t actually apply, which means administrators either don’t notice, or actively check and test (which means more time).

So, in short, there’s a trust gap for this particular patch, and I believe that’s what we see reflected in the low patch numbers. Even if the patch is easy and clean and works great, an experienced Exchange admin isn’t going to trust it.

ccondon-r7 (286)

March 06, 2020 11:31pm UTC (4 years ago)•Edited 4 years ago

Ratings

Common in enterprise Gives privileged access

Technical Analysis

There’s a Metasploit exploit module out for this now, and pen testers have reported that seeing vulnerable Exchange servers is common on engagements. As zeroSteiner has pointed out on Twitter, all that’s needed for reliable code execution is a domain user with a mailbox: https://twitter.com/zeroSteiner/status/1234983584177328129.
TrustedSec has a great write-up on IoCs here: https://www.trustedsec.com/blog/detecting-cve-20200688-remote-code-execution-vulnerability-on-microsoft-exchange-server/

tsellers-r7 (3)

March 05, 2020 10:29pm UTC (4 years ago)•Edited 4 years ago

Ratings

Common in enterprise Gives privileged access Vulnerable in default configuration Authenticated

Technical Analysis

Discovery Notes

You can determine the version of Microsoft Exchange that the Client Access Servers (CAS) are running prior to authentication. Visit the OWA login page ( https://owa.probablyunpatched.com/owa/auth/logon.aspx) and view the source.

@font-face {
    font-family: "Segoe UI WPC";
    src: url("/owa/auth/15.0.1210/themes/resources/segoeui-regular.eot?#iefix") format("embedded-opentype"),
            url("/owa/auth/15.0.1210/themes/resources/segoeui-regular.ttf") format("truetype");
}

@font-face {
    font-family: "Segoe UI WPC Semilight";
    src: url("/owa/auth/15.0.1210/themes/resources/segoeui-semilight.eot?#iefix") format("embedded-opentype"),
        url("/owa/auth/15.0.1210/themes/resources/segoeui-semilight.ttf") format("truetype");
}

@font-face {
    font-family: "Segoe UI WPC Semibold";
    src: url("/owa/auth/15.0.1210/themes/resources/segoeui-semibold.eot?#iefix") format("embedded-opentype"),
        url("/owa/auth/15.0.1210/themes/resources/segoeui-semibold.ttf") format("truetype");
}

The versions there can be compared to the Exchange build lookup list provided by Microsoft
https://docs.microsoft.com/en-us/exchange/new-features/build-numbers-and-release-dates?view=exchserver-2019

The following Exchange versions may be safe. Microsoft isn’t consistently updating the build number as part of the update installation process. Anything newer is probably patched.

Exchange Release	Build Number
Microsoft Exchange Server 2019 Cumulative Update 4 + hotfix	15.2.529.xxx
Microsoft Exchange Server 2019 Cumulative Update 3 + hotfix	15.2.464.xxx
Microsoft Exchange Server 2016 Cumulative Update 16 + hotfix	15.1.1979.xxx
Microsoft Exchange Server 2016 Cumulative Update 15 + hotfix	15.1.1913.xxx
Microsoft Exchange Server 2016 Cumulative Update 14 + hotfix	15.1.1847.xxx
Microsoft Exchange Server 2013 Cumulative Update 23 + hotfix	15.0.1497.xxx
Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30	14.3.496.xxx

Any version matching those listed below or that are older than those listed below are definately vulnerable.

Exchange Release	Build Number
Microsoft Exchange Server 2019 Cumulative Update 2	15.2.397.3
Microsoft Exchange Server 2016 Cumulative Update 14	15.1.1779.2
Microsoft Exchange Server 2013 Cumulative Update 22	15.0.1473.3
Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 29	14.3.487.0

gwillcox-r7 (579)

October 20, 2020 6:47pm UTC (4 years ago)•Edited 4 years ago

Technical Analysis

This is now supposedly being exploited in the wild by Chinese state actors according to this NSA announcement: https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF

jbarto (3)

February 28, 2020 4:51pm UTC (4 years ago)•Edited 4 years ago

Ratings

Attacker Value

Very High

Exploitability

Medium

Gives privileged access Requires user interaction

Technical Analysis

Exchange Servers exposed to the outside (OWA) will need to patch this as soon as possible. Internal Exchange is not a high priority. The requirement of knowing the validation key is required to exploit. There is discussion that a specially crafted email may trigger this vulnerability with the way Exchange handles memory objects which can lead to remote code execution.
Several POC are available although the skill level to exploit is higher with the need to write custom code.
Recommended to patch if Exchange is exposed outside of the environment.
This was patched in the Feb 2020 patch release from Microsoft.
High/Critical depending on controls to expose Exchange to the internet.
Low/Moderate for internal Exchange depending on the environment.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

8.8 High

Impact Score:

5.9

Exploitability Score:

2.8

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV):

Network

Attack Complexity (AC):

Low

Privileges Required (PR):

Low

User Interaction (UI):

None

Scope (S):

Unchanged

Confidentiality (C):

High

Integrity (I):

High

Availability (A):

High

Vendors

microsoft

Products

exchange server 2010,
exchange server 2013,
exchange server 2016,
exchange server 2019

Metasploit Modules

Exchange Control Panel ViewState Deserialization (https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_ecp_viewstate.rb)

Exploited in the Wild

Reported by:

ccondon-r7

Reported: September 08, 2020 5:06pm UTC (4 years ago)

gwillcox-r7 indicated sources as

Government or Industry Alert (https://us-cert.cisa.gov/ncas/alerts/aa21-209a)
Threat Feed (https://www.sentinelone.com/labs/wading-through-muddy-waters-recent-activity-of-an-iranian-state-sponsored-threat-actor/)
News Article or Blog (https://www.tenable.com/blog/contileaks-chats-reveal-over-30-vulnerabilities-used-by-conti-ransomware-affiliates)
Other: 2020 Most Exploited Vulnerabilities (https://www.ic3.gov/Media/News/2021/210728.pdf)

Reported: July 28, 2021 3:34pm UTC (3 years ago) • Edited 2 years ago

AttackerKB Worker indicated source as Government or Industry Alert (https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

Reported: November 08, 2024 8:15am UTC (1 month ago)

References

Canonical

CVE-2020-0688 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0688)

Exploit

PoCs that have not been added by contributors directly have been sourced from: nomi-sec/PoC-in-GitHub.
A PoC added here by the AKB Worker must have at least 2 GitHub stars.

CVE-2020-0688-GUI (https://github.com/W01fh4cker/CVE-2020-0688-GUI) (Added by AKB Worker)

Miscellaneous

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688

https://www.zerodayinitiative.com/advisories/ZDI-20-258

http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.html

http://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.html

Rapid7

Very High