CrowdStrike Update Causes BSOD Issues Globally – Audit Available 🛡️ Learn more

TRY NOW

Microsoft Exchange CVE-2022-41040 & CVE-2022-41082 Audit

Exchange Software Vulnerability

Discover All Exchange Servers in Your Network Vulnerable to CVE-2022-41040 & CVE-2022-41082

News broke of two actively exploited zero-day vulnerabilities in Microsoft Exchange 2013, 2016 and 2019. First reported by the Zero Day Initiative and with the references ZDI-CAN-18333 (CVSS score: 8.8) and ZDI-CAN-18802 (CVSS score: 6.3). These vulnerabilities can lead to remote code execution when exploited. Microsoft followed soon with the official disclosure of the vulnerabilities, now also listed as CVE-2022-41040 and CVE-2022-41082, “CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, while the second, identified as CVE-2022-41082, allows remote code execution (RCE) when PowerShell is accessible to the attacker”. You can find more info including how to mitigate the vulnerability until a patch has been released in our Exchange CVE-2022-41040 and CVE-2022-41082 blog post. The report below will provide an overview of all Microsoft Exchange 2013, 2016, and 2019 servers that require action.

Exchange Scanned Servers Query

Select Top 1000000 tblAssets.AssetID,
tblAssets.AssetName,
tblAssets.Domain,
tblAssets.Username,
tblAssets.Userdomain,
Coalesce(tsysOS.Image, tsysAssetTypes.AssetTypeIcon10) As icon,
tblAssets.IPAddress,
tsysIPLocations.IPLocation,
tblAssetCustom.Manufacturer,
tblAssetCustom.Model,
tsysOS.OSname As OS,
tblAssets.Version,
tblExchangeServer.AdminDisplayVersion as [Exchange Admin Display Version],
Case 
When tblExchangeServer.AdminDisplayVersion like '%15.0%' 
then 'Exchange Server 2013'
When tblExchangeServer.AdminDisplayVersion like '%15.1%' 
then 'Exchange Server 2016'
When tblExchangeServer.AdminDisplayVersion like '%15.2%' 
then 'Exchange Server 2019'
end as [Exchange Server Version],
tblExchangeServer.ExchangeVersion as [Exchange Version],
tblExchangeServer.Edition,
tblExchangeServer.ServerRole,
Case
When tblErrors.ErrorText Is Not Null Or
tblErrors.ErrorText != '' Then
'Scanning Error: ' + tsysasseterrortypes.ErrorMsg
Else ''
End As ScanningErrors,
tblAssets.Lastseen,
tblAssets.Lasttried
From tblAssets
Inner Join tblAssetCustom On tblAssets.AssetID = tblAssetCustom.AssetID
Inner Join tsysAssetTypes On tsysAssetTypes.AssetType = tblAssets.Assettype
Inner Join tsysIPLocations On tsysIPLocations.LocationID =
tblAssets.LocationID
inner join tblExchangeServer on tblExchangeServer.AssetId = tblassets.AssetID
Inner Join tblState On tblState.State = tblAssetCustom.State
Left Join tsysOS On tsysOS.OScode = tblAssets.OScode
Left Join (Select Distinct Top 1000000 tblErrors.AssetID As ID,
Max(tblErrors.Teller) As ErrorID
From tblErrors
Group By tblErrors.AssetID) As ScanningError On tblAssets.AssetID =
ScanningError.ID
Left Join tblErrors On ScanningError.ErrorID = tblErrors.Teller
Left Join tsysasseterrortypes On tsysasseterrortypes.Errortype =
tblErrors.ErrorType
Where tblState.Statename = 'Active' and 
(tblExchangeServer.AdminDisplayVersion like '%15.0%' or 
tblExchangeServer.AdminDisplayVersion like '%15.1%' or 
tblExchangeServer.AdminDisplayVersion like '%15.2%')
Order By tblAssets.Domain,
tblAssets.AssetName

Show

Hide

NO CREDIT CARD REQUIRED

Ready to get started?
You’ll be up and running in no time.

Explore all our features, free for 14 days.