⬇ Download holy card: ·
⚔ Commemorated today: The Day Facebook Vanished (2021)Saint ProxyNotShell, Who Was Not ProxyShell
Patron of on-premises Exchange servers, URL Rewrite rules written in a hurry, and names that say what they are not.
Life
At the end of September 2022 the Vietnamese firm GTSC reported attacks against fully patched Exchange servers: requests resembling ProxyShell, but with new bugs. There were two, an SSRF (CVE-2022-41040) and code execution via PowerShell (CVE-2022-41082), within reach of anyone with a mailbox. Kevin Beaumont called it ProxyNotShell, and while the patch kept everyone waiting until November, the temporary mitigations were bypassed one after another.
Prayer
O Saint ProxyNotShell, who goes by somebody else's name, let our mailboxes stay mailboxes and never become shells. Amen.
How to celebrate
Celebrated by installing the November 2022 Exchange security updates and finally deleting yet another URL Rewrite rule.
When the name says "not", expect a lot.