Microsoft has issued an urgent security advisory regarding a critical vulnerability in its Exchange Server product, identified as CVE-2024-21410. This vulnerability was actively exploited as a zero-day before being addressed in the recent Patch Tuesday update. The flaw allows remote, unauthenticated attackers to escalate privileges through NTLM relay attacks on vulnerable Exchange Server versions. Microsoft has responded by releasing a patch in Exchange Server 2019 Cumulative Update 14 (CU14), which includes NTLM credentials Relay Protections, also known as Extended Protection for Authentication (EPA).
Vulnerability Details:
- CVE ID: CVE-2024-21410
- Severity: Critical
- Impact: Privilege Escalation through NTLM Relay Attacks
- Affected Versions: Vulnerable Microsoft Exchange Server versions
- Remediation: Apply Exchange Server 2019 Cumulative Update 14 (CU14) to enable NTLM credentials Relay Protections (EPA)
Mitigation and Recommendations:
- Immediate Action: Customers are advised to promptly apply the CU14 update to their Exchange servers to mitigate the risk of exploitation.
- Extended Protection (EP): EP is now automatically enabled by default on all Exchange servers after installing the CU14 update. This feature strengthens Windows Server authentication functionality by mitigating authentication relay and man-in-the-middle (MitM) attacks.
- Environment Evaluation: Before enabling EP on Exchange servers, administrators should evaluate their environments and review the issues mentioned in Microsoft’s documentation for the EP toggle script to avoid breaking functionality.
- Monitoring and Vigilance: Customers are encouraged to monitor their systems for any signs of compromise and remain vigilant for any related security updates or advisories from Microsoft.
Additional Notes:
In a separate but related advisory, Microsoft also mistakenly tagged a critical Outlook remote code execution (RCE) vulnerability (CVE-2024-21413) as exploited in attacks before being fixed during the same Patch Tuesday update. Customers are advised to ensure that their Outlook applications are also updated to the latest version to address this vulnerability.
Stay safe and informed,
OP Innovate Research Team.
