⬇ Download holy card: ·
Saint OWASSRF, Who Came Back Through the Webmail
Patron of Exchange servers, webmail, and anyone who puts a mitigation on the wrong door.
Life
On 26 December 2022 CrowdStrike described OWASSRF, a chain discovered while investigating Play ransomware attacks. It combined CVE-2022-41080 and CVE-2022-41082, but unlike ProxyNotShell it came through an Outlook Web Access endpoint: so Microsoft's mitigations, built for Autodiscover, were not enough. What remained was to apply the November patch, or disable webmail.
Prayer
O Saint OWASSRF, who comes back through the webmail window when the door is barred, let our patches cover every way, not only one. Amen.
How to celebrate
Celebrated by applying the November 2022 Exchange patches and disabling OWA until you're sure.
Shut one door and the attacker tries the webmail.