{"id":793,"date":"2014-08-01T18:43:47","date_gmt":"2014-08-01T18:43:47","guid":{"rendered":"http:\/\/h.foofus.net\/?p=793"},"modified":"2014-08-03T16:32:57","modified_gmt":"2014-08-03T16:32:57","slug":"autodiscover-enumeration-vulnerability","status":"publish","type":"post","link":"http:\/\/h.foofus.net\/?p=793","title":{"rendered":"Autodiscover Enumeration Vulnerability"},"content":{"rendered":"

—————————————————————————————————————————————-
\n1. Summary<\/p>\n

The Microsoft Exchange Client Access Server (CAS) that services Autodiscover has been found vulnerable to an information disclosure. It has been discovered that a standard domain user without Exchange permissions can enumerate Autodiscover configuration files of Exchange users by an XML SOAP parameter injection. This issue can allow an attacker to confirm the existence of a specific email addresses. The type of information that is disclosed are things such as, legacy accounts and their username formats. The end user\u2019s full name is also revealed which could aid in locating a user\u2019s account. Exchange services, permissions, and the location of the domain controller that handles authentication are revealed as well.<\/p>\n

—————————————————————————————————————————————-
\n2. Description<\/p>\n

Autodiscover is a CAS service that is used to configure remote or internal mail clients for use with Exchange systems. Using a compatible mail client, the user can configure their client by providing an email address and password. The mail client goes through a discovery process to locate the remote CAS server hosting the Autodiscover configuration file. The configuration file is hosted on an IIS web server. By default the configuration file path is \u201c\/Autodiscover\/Autodiscover.xml\u201d. To access the Autodiscover.xml configuration file, an XML SOAP request is sent to the server using an HTTP POST method. Server side application controls require the User-Agent header of the request must represent that of an Outlook client, such as “Microsoft Office\/12.0”. The body of the SOAP request can be seen in Figure 1.<\/p>\n

FIGURE 1\u2014XML SOAP REQUEST BODY<\/p>\n

\"autodiscover_xml_request\"<\/a><\/p>\n

By examining the body of the SOAP request made, it was found that modifying the \u201cEmailAddress\u201d parameter to utilize another existing email address, the user’s configuration data can be enumerated. Using a single set of valid credentials, it is possible to inject the \u201cEmailAddress\u201d parameter to discover valid email addresses and gather data about the users and the environment. It was also found that even though valid Active Directory credentials are required to access the Autodiscover.xml file, it is not required to be a valid Exchange account with mailbox permissions. There are many ways to build an email address list that can be used when injecting the \u201cEmailAddress\u201d parameter, such as searching public databases, stripping metadata from published documents, by reviewing SMTP mail headers and services, or even by obtaining wordlists of the top most popular first and last names and creating a list of correctly formatted email addresses to try with this enumeration attack.<\/p>\n

—————————————————————————————————————————————-
\n3. Impact<\/p>\n

Allows an attacker to enumerate Exchange user and environment information which could lead to further compromise such as password guessing attacks, social engineering, and learning about internal systems. The impact should be categorized as an information disclosure vulnerability.<\/p>\n

—————————————————————————————————————————————-
\n4. Affected Products<\/p>\n

Microsoft Exchange CAS 2013
\nMicrosoft Exchange CAS 2010
\nMicrosoft Exchange CAS 2007<\/p>\n

—————————————————————————————————————————————-
\n5. Time Line<\/p>\n

05\/27\/2014 Reported Vulnerability to the Vendor
\n06\/26\/2014 Vendor Confirmed the Vulnerability
\n08\/01\/2014 Publicly Disclosed<\/p>\n

—————————————————————————————————————————————-
\n6. Credits<\/p>\n

Discovered by Nate Power<\/p>\n

—————————————————————————————————————————————-<\/p>\n","protected":false},"excerpt":{"rendered":"

—————————————————————————————————————————————- 1. Summary The Microsoft Exchange Client Access Server (CAS) that services Autodiscover has been found vulnerable to an information disclosure. It has been discovered that a standard domain user without Exchange permissions can enumerate Autodiscover configuration files of Exchange users by an XML SOAP parameter injection. This issue can allow an attacker to confirm […]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-793","post","type-post","status-publish","format-standard","hentry","category-advisories"],"_links":{"self":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/posts\/793","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=793"}],"version-history":[{"count":6,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/posts\/793\/revisions"}],"predecessor-version":[{"id":812,"href":"http:\/\/h.foofus.net\/index.php?rest_route=\/wp\/v2\/posts\/793\/revisions\/812"}],"wp:attachment":[{"href":"http:\/\/h.foofus.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=793"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=793"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/h.foofus.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=793"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}