Maximize your protection, eliminate business risks.
Optimize and modernize with cloud transformation.
Empower your people to work securely from anywhere.
What it takes to convince leadership that migrating to the cloud is the right move.
Let us handle IT so you can focus on growing your business.
Get multichannel 24/7/365 expert end-user support.
Stay ahead of attacks with 24/7 protection and monitoring.
Maximize uptime with with industry-leading DRaaS.
Improve efficiency, productivity and outcomes with cloud.
Ensure all mobile devices, everywhere, are secure.
Gain a competitive edge with strategic IT solutions.
This battle-tested checklist enables your team to swiftly initiate a ransomware response.
IT for businesses of all sizes, in any industry.
Empower institution growth with custom IT solutions.
Ensure your firm is always in compliance.
Improve patient care and staff morale.
Deal with pressing legal matters, not IT.
Keep up with the evolving digital landscape.
Focus on your mission by outsourcing IT.
Accelerate PE client deals and secure data.
Leverage your technology as a strategic asset.
Execute initiatives and develop IT strategies.
Get the latest industry insights and trends.
Join us at events in person and online.
Hear from clients and learn more about strategic IT.
See how Dataprise can make IT your greatest asset.
Get informative technical resources from IT experts.
Stay on stop of emerging cybersecurity threats.
Discover the key areas of DR your organization needs to address to ensure downtime is minimized.
Gain a strategic asset by bringing harmony to IT.
Ensure 24/7 support and security with dedicated teams.
Drive business forward by partnering with Dataprise.
Meet our one-of-a-kind leadership team.
Discover the recognition Dataprise has earned.
Help us help businesses with strategic IT.
Embracing different perspectives and backgrounds.
Find a Dataprise location near you.
Dataprise is committed to empowering more women to consider a career in technology.
Defense Digests
Table of content
Dataprise Defense Digest
ID: 2024-0002-1
Severity: Critical (9.8)
Published: February 15, 2023
On February 13, 2024, Microsoft released a critical vulnerability (9.8 CVSS) being tracked as CVE-2024-21410 for a vulnerability found in Exchange Server. As of this time, the vulnerability has been, and is currently being exploited in the wild. The exploit is described as a privilege escalation technique that would allow the bad actor to successfully complete pass-the-hash attacks. Upon further investigation into the matter, Microsoft has uncovered that the initial vector of the attack was being allowed due to Extended Protection for Authentication (EPA) not being enabled by default in Exchange Server 2019. The company has since addressed this vulnerability with the release of Exchange Server 2019 Cumulative Update 14 (CU14). Russian state-affiliated hacking crews such as APT28 (aka Forest Blizzard) have a history of exploiting flaws in Microsoft Outlook to stage NTLM relay attacks.
Dataprise is aware of the critical nature of this vulnerability and is conducting a review of all available analyses of these vulnerabilities and the potential impact on our clients. This has been a major exercise as the investigation requires that a specific order of actions is taken to achieve the response objectives. Right now, our teams are working to confirm whether the recommended mitigation steps can be applied without causing any customer-facing service interruptions.
According to Microsoft, a bad actor could exploit this flaw and relay the legitimate user’s Net-NTLMv2 hash against the weakened server to then authenticate as the user. Microsoft notes that “An attacker could target an NTLM client such as Outlook with an NTLM credentials-leaking type vulnerability. The leaked credentials can then be relayed against the Exchange server to gain privileges as the victim client and to perform operations on the Exchange server on the victim’s behalf”. No further details have been released pertaining to the parties that are actively exploiting this vulnerability. Dataprise highly recommends reading the knowledge article provided by Microsoft and implementing the Cumulative Update to patch this critical vulnerability.
Microsoft has provided the following knowledge article explaining the fix for the existing vulnerability and includes the download location for the Exchange Server 2019 Cumulative Update.
Microsoft has provided the below knowledge article outlining the necessary steps and script to employ the fix for older Exchange Server versions.
REFERENCES
CONTRIBUTING AUTHORS
INSIGHTS
Subscribe to get real-time notifications when a new Dataprise Defense Digest is published.