Mitigation for Exchange Servers Hafnium Zero-day vulnerabilities

Posted by Zevenet | 18 March, 2021 | Technical

Even though it has been only a few months since the already famous attack on the SolarWinds supply chain, again we have to write about another hacking issue, this time related to Microsoft Exchange Server.

In this case, the Zero-day vulnerabilities found in Microsoft Exchange Server 2013, 2016, and 2019 permit an attacker to exploit them with impact to several organizations and businesses with on-premises Exchange Servers that enable access to email accounts and even installation of malware to allow long-term access to such servers. Microsoft detected the attacks from the Hafnium group, but also, others could have been using these 0-day exploits now that the attacks have been public.

These vulnerabilities have been registered and documented with the codes CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065, and all of these have been addresses so urgent updates are strongly recommended to customers.

If you’re concerned about these attacks, we recommend implementing high availability solution plus a web application firewall in order to mitigate them, like the ZEVENET solution. If the Exchange Server update is not possible, Microsoft recommends implementing the following mitigations:

1. Trusted users mitigation: Access to the Microsoft Exchange Servers for trusted users only via VPN service.
2. Backend Cookie Mitigation: Implement a Web Application Firewall rule to filter the malicious HTTPS requests using X-AnonResource-Backend and malformed X-BEResource cookies in the headers used in the SSRF attacks.
3. Unified Messaging mitigation: Disable UM
4. Exchange Control Panel mitigation: Disable ECP VDir
5. Offline Address Book mitigation: Disable OAB VDir

At ZEVENET, we’ve been working to implement those very easily via the WAF module and brand new VPN services. Also, high availability, additional security, and load balancing for Exchange Servers can be implemented with ZEVENET:

https://www.zevenet.com/knowledge-base/howtos/high-availability-and-site-resilience-for-microsoft-exchange-2016-owa-cas-array-and-dag/

Don’t doubt to contact us to have more details on how to implement those mitigations!

Official info related to these Microsoft vulnerabilities:

https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
https://msrc-blog.microsoft.com/2021/03/05/microsoft-exchange-server-vulnerabilities-mitigations-march-2021/

SHARE ON:

Related Blogs

Posted by zenweb | 01 September 2022
Load balancing is common in the computing world. It came about due to users wanting content quickly. This meant that high‑traffic websites that get millions of user requests had to…
367 LikesComments Off on How load balancing works
Posted by zenweb | 30 August 2022
Healthcare is highly vulnerable to security threats, just like any other industry. Nowadays, cyberattacks in healthcare are very common leading to a lot of risks, specifically security risks to be…
379 LikesComments Off on The Importance of Cybersecurity Frameworks in Healthcare
Posted by zenweb | 02 August 2022
7 Reasons ZEVENET is the best Load Balancing software in 2022 Load balancing solution is no longer what it used to be in the past. As technology improves, threats also…
400 LikesComments Off on 7 Reasons ZEVENET is the best Load Balancing software in 2022