CVE-2020-0688
CVE-2020-0688
Em resumo
O Microsoft Exchange possui uma vulnerabilidade que permite a invasores executar código malicioso remotamente no servidor. Isso ocorre porque o software não gerencia adequadamente dados na memória, podendo dar controle total do sistema de email a usuários não autorizados.
Detalhe técnico
Uma vulnerabilidade de corrupção de memória no Microsoft Exchange permite execução remota de código quando a aplicação falha em validar ou sanitizar adequadamente objetos armazenados na memória. Um atacante autenticado pode explorar isso para alcançar execução de código arbitrário com os privilégios do processo Exchange, comprometendo completamente o servidor de mail.
Resumo gerado e traduzido por IA a partir da descrição oficial.
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
Microsoft · Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30Microsoft · Microsoft Exchange Server 2013Microsoft · Microsoft Exchange Server 2016 Cumulative Update 14Microsoft · Microsoft Exchange Server 2016 Cumulative Update 15Microsoft · Microsoft Exchange Server 2019 Cumulative Update 3Microsoft · Microsoft Exchange Server 2019 Cumulative Update 4PoCs públicas encontradas — 30
githubgithub.com/zcgonvh/CVE-2020-0688★ 354githubgithub.com/Ridter/cve-2020-0688★ 326githubgithub.com/random-robbie/cve-2020-0688★ 165githubgithub.com/Yt1g3r/CVE-2020-0688_EXP★ 145githubgithub.com/Jumbo-WJB/CVE-2020-0688★ 66githubgithub.com/onSec-fr/CVE-2020-0688-Scanner★ 37githubgithub.com/w4fz5uck5/cve-2020-0688-webshell-upload-technique★ 23githubgithub.com/MrTiz/CVE-2020-0688★ 21githubgithub.com/W01fh4cker/CVE-2020-0688-GUI★ 16githubgithub.com/zyn3rgy/ecp_slap★ 11githubgithub.com/ravinacademy/CVE-2020-0688★ 11githubgithub.com/youncyb/CVE-2020-0688★ 10githubgithub.com/cert-lv/CVE-2020-0688★ 8githubgithub.com/justin-p/PSForgot2kEyXCHANGE★ 5githubgithub.com/murataydemir/CVE-2020-0688★ 4githubgithub.com/ktpdpro/CVE-2020-0688★ 3githubgithub.com/1337-llama/CVE-2020-0688-Python3★ 2githubgithub.com/mahyarx/Exploit_CVE-2020-0688★ 2githubgithub.com/SLSteff/CVE-2020-0688-Scanner★ 2githubgithub.com/righter83/CVE-2020-0688★ 2githubgithub.com/ann0906/proxylogon★ 1githubgithub.com/truongtn/cve-2020-0688★ 1githubgithub.com/chudamax/CVE-2020-0688-Exchange2010★ 1githubgithub.com/tvdat20004/CVE-2020-0688★ 0githubgithub.com/7heKnight/CVE-2020-0688★ 0githubgithub.com/iamwajd/Cyber-Attack-Analysis★ 0cve_referencepacketstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.htmlnão verificadocve_referencepacketstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.htmlnão verificadoexploitdbwww.exploit-db.com/exploits/48153não verificadoexploitdbwww.exploit-db.com/exploits/48168não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Quer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →Referências
http://packetstormsecurity.com/files/156592/Microsoft-Exchange-2019-15.2.221.12-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/156620/Exchange-Control-Panel-Viewstate-Deserialization.htmlhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0688https://www.zerodayinitiative.com/advisories/ZDI-20-258/