ProxyNotShell Exchange autodiscover SSRF to PowerShell (CVE-2022-41040/41082)

ills3c Intel&Coffee@Ills3C

•updated 12 days ago•2•0•3

Detects HTTP requests targeting Microsoft Exchange servers that combine the autodiscover.json URI with PowerShell endpoint parameters, indicative of ProxyNotShell vulnerabilities exploitation (CVE-2022-41040 and CVE-2022-41082).