Researchers from Shadowserver Foundation identified roughly 28,000 internet-facing Microsoft Exchange servers vulnerable to CVE-2024-21410.
The vulnerability CVE-2024-21410 is a bypass vulnerability that can be exploited by an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both.
“An attacker could target an NTLM client such as Outlook with an NTLM credentials-leaking type vulnerability. The leaked credentials can then be relayed against the Exchange server to gain privileges as the victim client and to perform operations on the Exchange server on the victim’s behalf. For more information about Exchange Server’s support for Extended Protection for Authentication(EPA), please see Configure Windows Extended Protection in Exchange Server.” reads the advisory published by Microsoft.
The IT giant addressed the issue with the release of Patch Tuesday security updates for February 2024.
Last week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. Microsoft also updated its advisory to label the flaw as actively exploited in the wild.
On 2024-02-17 Shadowserver researchers identified around 97K vulnerable or possibly vulnerable (vulnerable version but may have mitigation applied).
Out of 97,000 servers, 28,500 have been verified to be vulnerable to CVE-2024-21410.
Most of these servers are in Germany, followed by the United States. Below are the data shared by Shadowserver:
| Country | Counted IP addresses |
|---|---|
| Germany | 25,695 |
| United States | 21,997 |
| United Kingdom | 4,130 |
| Netherlands | 3,505 |
| France | 3,381 |
| Austria | 3,337 |
| Russia | 3,069 |
| Canada | 2,891 |
| Switzerland | 2,404 |
| Australia | 2,148 |
| Italy | 2,048 |
| Czechia | 1,392 |
| China | 1,221 |
| Belgium | 919 |
| Turkey | 881 |
| Taiwan | 870 |
| Hong Kong | 742 |
| Hungary | 624 |
| Spain | 570 |
| South Africa | 563 |
However, the researchers warn that the above results were calculated by summing counts of unique IPs, which means that a “unique” IP may have been counted more than once.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – ransomware, Microsoft Exchange)