A weakness in certain configurations of Microsoft Exchange enables attackers to send an email from any user to a vulnerable organization.
That’s according to Swiss cybersecurity firm InfoGuard, which published research today concerning a new vulnerability it described as “Ghost-Sender.” Specifically, organizations that use Exchange Online or on-premises in hybrid mode with a third-party mail server or spam filter as its mail exchange (MX) record are vulnerable to this level of spoofing. MX Records are a type of DNS record that directs email messages to the specific server responsible for an organization’s domain.
“This is regardless of the configured SPF, DKIM, and DMARC policies of the spoofed sender’s domain, and the emails are delivered without any further warning,” InfoGuard puts in a blog post.
“It is possible to send emails from anyone, including external and internal email addresses. For internal senders, Outlook even resolves the sender’s profile picture,” InfoGuard adds, showing one example where a user received an email claiming to be from Microsoft’s official noreply account. An attacker could send fake bills from an official billing email to an organization or conduct phishing attacks or fraud using the internal CEO’s actual email address.
Researchers claim this is a widespread misconfiguration, and that while mitigations are available, fewer than half of organizations with an external-facing MX record have a mitigation applied.
More concerning, “Based on information provided by Microsoft support, this issue or an adjacent one appears to be actively being abused,” the blog post read. InfoGuard claimed Microsoft deployed and rolled back a mitigation to the spoofing attack it observed.
How Ghost-Sender Works
By default, InfoGuard says, Exchange Online accepts any incoming emails if an external MX record is used by the organization. All an attacker needs to do at that point is send a one-line PowerShell command that sends an email from whatever user the attacker wishes.
“If an external MX record is used and no further configurations are made, the organization is vulnerable to Ghost-Sender,” InfoGuard says. It’s so simple and straightforward that the company even created a testing tool to scan domains and send emails to authorized users.
The researchers say Microsoft’s own configuration analyzer fails to show warnings or recommendations, nor does it offer any other warnings that a configuration may be vulnerable. Enhanced filtering allegedly doesn’t prevent the issue either, nor do the “Strict” and “Standard” Exchange protection settings.
Organizations using Exchange Online or on-premises Microsoft Exchange in hybrid mode can mitigate the threat of Ghost-Sender in one of two ways. They can set up a partner organization connector that applies to emails being sent to any organization or rejects emails based on IP or certificate-based validation.
Or, organizations can create a mail flow rule that “quarantines all emails where the X-MS-Exchange-Organization-AuthAs header is not set to Internal and where the IP address does not belong to one expected to send emails to Exchange Online (such as the mail server the MX record points to).”
Organizations can test the quality of the mitigations through the aforementioned testing tool InfoGuard provided. Researchers also recommend disabling the Direct Send feature because doing so protects against internal spoofing on its own.
Ghost-Sender’s Timeline and a Questionable Response
In a blog “timeline” section, InfoGuard claimed it initially reported the issue to Microsoft Security Response Center (MSRC) in April, but the vendor closed the issue as a non-MSRC case because the company allegedly didn’t view it as a security vulnerability.
InfoGuard was directed to general Microsoft support and was seemingly met with irregular communication until May 29 when, the blog post claimed, Microsoft general support said Ghost-Sender was not a product vulnerability but instead a known architectural limitation. “They suggest either changing the MX record to M365 or adding additional headers in forwarded emails (which doesn’t fix the issue),” the company said.
Dark Reading contacted Microsoft for comment, but the company did not provide a response by press time.
Dark Reading asked InfoGuard how organizations can tell they may have been targeted after applying mitigations. A RedTeam InfoGuard spokesperson says it’s difficult to find reliable indicators of compromise due to the multitude of different Exchange licenses, tenants, and configurations that customers have.
“One possible option is to check the received headers of all incoming mails for discrepancies in the mail gateway flow,” the spokesperson says. “An attacker would require internal information, such as the internal IP addresses and internal host names of the appliances along the mail path, to be able to spoof this information correctly during a ghost-send.”
No responses yet