---
title: "Exchange ProxyNotShell SSRF (CVE-2022-41040)"
canonical: https://trickest.com/library/cve-2022-41040-exchange-proxynotshell-ssrf
description: "Flag Microsoft Exchange hosts for CVE-2022-41040 by reading the OWA version path on GET /owa/auth/logon.aspx. 15.0/15.1/15.2 floors. No SSRF."
---

# Exchange ProxyNotShell SSRF (CVE-2022-41040)

## Overview

This workflow finds Microsoft Exchange Server and sorts each host by whether its OWA build falls below the CVE-2022-41040 fixed floors. CVE-2022-41040 is ProxyNotShell server-side request forgery on Exchange. This check never hits Autodiscover and never sends an SSRF probe. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/owa/auth/logon.aspx`, fingerprints Exchange from OWA markers on that page, parses the version from the `/owa/auth/<build>/` path, and compares that tuple to the 15.0, 15.1, and 15.2 bands in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). There is no URL Rewrite check, no RCE claim, and no confirm step.

Run it on a schedule when CAS hosts turn over. A restored mailbox role that lands on a pre-SU build is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/owa/auth/logon.aspx` on each host and fingerprint Exchange from markers such as `/owa/auth/`, `logon.aspx`, `X-OWA-Version`, and Microsoft Exchange strings.
3. Parse the build from the `/owa/auth/<n.n.n.n>/` path and compare it to the CVE-2022-41040 15.0 / 15.1 / 15.2 floors in the graph.
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Exchange was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/owa/auth/logon.aspx` only. No Autodiscover SSRF and no second confirm request.

## Sample output

The records below are illustrative and do not come from a real run. They show one Exchange host below a CVE-2022-41040 floor, one at or above its band floor, and one host that is not the product.

```jsonl
{"url": "https://mail.example.com", "is_product": true, "product_version": "15.2.1118.12", "vulnerable": true, "detail": "below band floor 15.2.1118.20"}
{"url": "https://mail.example.org", "is_product": true, "product_version": "15.2.1118.20", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Microsoft Exchange Server"}
```

```json
{"cve": "CVE-2022-41040", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which Exchange versions does this flag?

Builds below the 15.0 / 15.1 / 15.2 floors in the graph: 15.0.1497.44, 15.1.2375.37, 15.1.2507.16, 15.2.986.36, and 15.2.1118.20. A version picks the matching band, then compares to that band's floor. The compare uses the OWA path version on `/owa/auth/logon.aspx`.

### Does an affected row mean SSRF worked?

No. The check only GETs `/owa/auth/logon.aspx` and reads the OWA version path. It does not hit Autodiscover, does not check URL Rewrite, and does not confirm SSRF or RCE.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of the public OWA logon page. It does not log in or send an SSRF payload.

### Does the check need credentials?

No. It fingerprints the public OWA logon page the way an external scanner would.

### What is CVE-2022-41040?

ProxyNotShell server-side request forgery in Microsoft Exchange Server. This workflow maps hosts to that CVE by OWA version exposure only.

## Related workflows

- [Exchange ProxyNotShell RCE (CVE-2022-41082)](/library/cve-2022-41082-exchange-proxynotshell-rce). Reach for it when you need the companion ProxyNotShell RCE fingerprint on the same fleet.
- [Exchange privilege escalation (CVE-2022-41080)](/library/cve-2022-41080-exchange-privilege-escalation). Reach for it when the next Exchange flag is privilege escalation, not SSRF.
- [Exchange deserialization RCE (CVE-2023-21529)](/library/cve-2023-21529-exchange-deserialization-rce). Reach for it when you need the later Exchange deserialization fingerprint.

---
_Markdown source of https://trickest.com/library/cve-2022-41040-exchange-proxynotshell-ssrf._