How to safeguard your servers against ProxyShell vulnerabilities?

What is ProxyShell vulnerability?

Before I tell you how to safeguard against this weakness, let’s understand it a bit more. ProxyShell is not a single bug, but a combination of 3 vulnerabilities together (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207). These were found in Exchange Server security in 2021.

It is considered one of the most severe flaws in Exchange history. Attackers can use it to allow unauthenticated remote code execution (RCE). In this type of attack, they don’t require a password; all they do is send a request to server with malicious code. And once inside, they can run cmdlets as an admin, which grants them complete control over the server.

Example: The LockFile Attack
A famous example of how attackers use this vulnerability to attack Exchange Server is the LockFile ransomware attack in 2021. This ransomware uses a unique technique called “intermittent encryption”. It encrypts every 16 bytes to bypass antivirus detection. This attack serves as a reminder to organizations that even a small ransomware group could cripple major organizations with a single weakness.

Which sectors are targeted most?

The ProxyShell attacks do not target typical home users. But look specifically for organizations that use Exchange Server On-Premises setup. Most common targets are:

Government & Public Sector: You will find old legacy infrastructures installed here, which are vulnerable to attacks.

Healthcare & Education: These sectors hold sensitive data and frequently operate on tight IT budgets, leading to outdated server maintenance.

Legal & Finance: High-value targets where email downtime equals massive financial loss.

How to prevent ProxyShell ransomware attacks?

You need a powerful strategy to secure your Exchange Server against the ProxyShell weakness. You can use the following techniques to secure your servers:

Regular system updates: It’s the simplest and most important thing to do. Install latest software patches (cumulative updates) as soon as they are launched. The ProxyShell attack will not work on latest Exchange Server.

Database backup: Even if your data is compromised, as long as you hold a consistent backup you can get back your data. For fast and reliable backup, use a professional EDB to PST converter tool and backup every mailbox.

Disable Features: Sometimes immediate patching is possible. In such a case, the administrators should disable features like Client Access Service (CAS) that are used to exploit the servers.

Network Segmentation: If your work involves using a specific old Exchange version, you must isolate the databases. Even if a hacker gets into one server, the network isolation will prevent them from attacking other connected servers.

What to do if your Exchange database is compromised?

If the prevention fails and a ProxyShell attack corrupts your database, immediately use our tool, Kernel for Exchange Server, to recover 100% of your data. The tool helps with:

Repair Corrupt EDB File: The ransomware attacks often damage your Exchange database file. Our tool uses powerful recovery algorithms to deeply scan and repair EDB files.

Complete Data Recovery: You don’t need to pay any ransom to the attacker, use our tool to easily recover all emails, attachments, contacts, folders, and data items with original metadata.

Migration and Backup: After repairing or recovering your EDB file, you can directly save the data to a Live Exchange or Office 365 environment. Furthermore, the tool also allows you to back up the data locally in the PST file.

Conclusion

The ProxyShell weakness has been fixed by Microsoft, and the modern Exchange Server is safe from it. But attackers are always looking for a system with an outdated patch. Furthermore, modern-day cybercriminals are now using AI-driven ransomware scripts based on the ProxyShell vulnerability.

Always use the latest versions of the Exchange Server and perform regular server updates & maintenance. Additionally, use the preventive techniques discussed in the blog. In case your EDB file gets corrupted, use the advanced Exchange database recovery tool to recover data with 100% integrity and folder hierarchy.