Saint ProxyNotShell, Who Was Not ProxyShell

Patron of on-premises Exchange servers, URL Rewrite rules written in a hurry, and names that say what they are not.

Life

At the end of September 2022 the Vietnamese firm GTSC reported attacks against fully patched Exchange servers: requests resembling ProxyShell, but with new bugs. There were two, an SSRF (CVE-2022-41040) and code execution via PowerShell (CVE-2022-41082), within reach of anyone with a mailbox. Kevin Beaumont called it ProxyNotShell, and while the patch kept everyone waiting until November, the temporary mitigations were bypassed one after another.

Prayer

O Saint ProxyNotShell, who goes by somebody else's name, let our mailboxes stay mailboxes and never become shells. Amen.

How to celebrate

Celebrated by installing the November 2022 Exchange security updates and finally deleting yet another URL Rewrite rule.

When the name says "not", expect a lot.