SSRF + Exchange = Disaster (And It’s Happening Now)

What's happening right now

Attackers are exploiting SSRF vulnerabilities to completely bypass your Exchange authentication. They're tricking your server into making requests on their behalf, then chaining that with other flaws to get remote code execution.

Here's the scary part: Microsoft's research shows these attacks are happening thousands of times per day. Their security systems are blocking massive volumes of these attempts, which means attackers are actively probing Exchange servers right now—including yours.

Take CVE-2022-41040, the AutoDiscover SSRF flaw. Attackers use this to impersonate users and trigger backend functions that should require authentication. Once they're in, they're not just grabbing a few emails. They're dropping web shells, using Exchange Web Services (EWS) APIs to map your entire mailbox structure, and systematically stealing your most sensitive communications.

The knowledge gap that's hurting us

Most of us understand basic web vulnerabilities, but SSRF is different. It's not just about input validation—it's about understanding how server components trust each other and how that trust can be weaponized.

The problem gets worse when your Exchange server connects to cloud services. These SSRF attacks can pivot from your on-premises server to access cloud metadata services, storage accounts, and other resources that trust your email infrastructure.

We're seeing attacks that blend perfectly with normal Hypertext Transfer Protocol Secure (HTTPS) traffic. Your security tools think everything looks fine while attackers systematically compromise your email system.

How cloud security knowledge helps

Understanding these hybrid attacks requires going beyond traditional security training. You need to know how attackers exploit trust relationships between on-premises and cloud environments.

One way to familiarize yourself with securing the cloud is through certifications like Certified Cloud Security Professional (CCSP). CCSP covers scenarios like these—how SSRF can be weaponized in cloud-hybrid environments, how to secure Application Programming Interface (API) integrations between on-premises and cloud services, and how to implement proper segmentation between different trust domains.

The key insight is that these aren't just network security issues—they're cloud-hybrid security challenges that require understanding both traditional infrastructure and modern cloud architectures.

What you need to do

First, the immediate steps: enable Antimalware Scan Interface (AMSI) integration on your Exchange servers, apply the latest security updates, and review which internal services your Exchange servers can access.

But don't stop there. Make sure your security team understands how SSRF works in hybrid environments. These attacks exploit the trust relationships between different parts of your infrastructure—knowledge that's critical as more organizations adopt cloud-hybrid architectures.

The SSRF attacks aren't slowing down. If anything, they're getting more sophisticated as attackers realize how effective they are against organizations that don't understand these hybrid attack patterns.

That’s it for this week. Stay tuned,
The DestCert team