# MA-1032.022024: MyCERT Advisory - Exploited as Zero Day – Microsoft Exchange Critical Vulnerability

**Date:** 17 Feb 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1032.022024  
**Advisory ID:** MA-1032.022024

---

**1.0 Introduction**
Recently, Microsoft has identified one of the critical vulnerabilities in Exchange Server that the company disclosed in February’s Patch Tuesday as actually being a zero-day threat that attackers are already actively exploiting.
CVE-2024-21410 is an elevation of privilege vulnerability that gives a remote, unauthenticated attacker a way to disclose and then relay Windows NT Lan Manager (NTLM) hashes to impersonate legitimate users on Exchange Server.
**2.0 Impact**
A cyber threat actor could exploit these vulnerabilities to take control of an affected system.
**3.0 Affected Products**
- Microsoft Exchange Server 2019
- Microsoft Exchange Server 2016
**4.0 Technical Details**
CVE2024-21410 allows remote unauthenticated threat actors to target an NTLM client such as Outlook in NTLM credential leaking attack. The leaked credentials can then be relayed against the Exchange server to gain privileges as the victim client and to perform operations on the Exchange server on the victim’s behalf. An attacker who successfully exploited this vulnerability could relay a user’s leaked Net-NTLMv2 hash against a vulnerable Exchange Server and authenticate as the user.
The problem in the case of CVE2024-21410 has to do with versions of Exchange Server 2019 prior to the Feb. 13 Update not enabling NTLM relay protections or Extended Protection of Authentication (EPA) by default. Without that protection, an attacker can relay leaked NTLM credentials from targets such as Outlook to Exchange Server.
**5.0 Recommendations**
CyberSecurity Malaysia encourages users and administrators to see the following table if the current server does not meet the prerequisites of EP:
|  | --- | --- | **Scenario that does not support EP** | **Action to take** | SSL Offloading for Outlook Anywhere | SSL Offloading for Outlook Anywhere [must be disabled](https://learn.microsoft.com/en-gb/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-extended-protection?view=exchserver-2019#outlook-anywhere-configuration-requirements). If Extended Protection is enabled via Exchange Server [CU14](https://techcommunity.microsoft.com/t5/exchange-team-blog/released-2024-h1-cumulative-update-for-exchange-server/ba-p/4047506), the installer will take care of disabling SSL Offloading for Outlook Anywhere. | SSL Offloading on Load Balancer | SSL Offloading is not supported. Use SSL bridging instead with the same SSL certificate as on Exchange Server IIS front end. | Public folders hosted on Exchange Server 2013, 2016 CU22 (or older) or 2019 CU11 (or older) | Move all Public folders to currently supported versions, decommission Exchange Server 2013 which is out of support. Check [this table](https://learn.microsoft.com/en-gb/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-extended-protection?view=exchserver-2019#extended-protection-and-public-folder-scenarios) for your Public Folder scenario. | Modern Hybrid agent is used to publish Exchange Server to the internet in hybrid scenario | Identify the Exchange Servers which are published via Modern Hybrid agent, by following the steps outlined [in this section](https://learn.microsoft.com/en-gb/exchange/plan-and-deploy/post-installation-tasks/security-best-practices/exchange-extended-protection?view=exchserver-2019#extended-protection-doesnt-work-with-hybrid-servers-using-a-modern-hybrid-configuration) of documentation. | On these servers, run Exchange Server CU14 setup in unattended mode and use the /DoNotEnableEP\_FEEWS switch to not enable Extended Protection on the EWS front end virtual directory. |
Administrators with Exchange Server 2016 can deploy EP using the [ExchangeExtendedProtectionManagement](https://microsoft.github.io/CSS-Exchange/Security/ExchangeExtendedProtectionManagement/) PowerShell script provided by Microsoft. Before enabling EP, administrators must thoroughly evaluate their environment due to potential compatibility issues with certain features.
CyberSecurity Malaysia also recommends users and administrators to review Microsoft’s update for [Exchange Server Elevation of Privilege Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21410) and apply the necessary updates:
Kindly refer to the following URL:<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21410>
Generally, were advise the users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact us through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: [https://www.mycert.org.my](https://www.mycert.org.my/) 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
6**.0    References**
- <https://www.darkreading.com/cyberattacks-data-breaches/microsoft-exchange-server-flaw-exploited-zero-day-bug>
- <https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21410>
- <https://securityonline.info/cve-2024-21410-cvss-9-8-microsoft-exchange-server-flaw-is-actively-exploited/?expand_article=1>