What this checks: whether a Microsoft Exchange host runs a version affected by unauth-chained deserialization RCE (ProxyNotShell). Read-only: it fingerprints Microsoft Exchange and reads the version, no exploitation.
3. Detection — reads the Microsoft Exchange version from the version exposed at /owa/auth/logon.aspx, compares to 15.2.1118.21 (Exchange 2019 CU12, Nov 2022 SU); see caveats for other CU lines. Flags vulnerable on an affected build. No exploitation.
1. Target List — paste your Microsoft Exchange URLs here, one per line (e.g. https://host.example.com).
Overview
This workflow finds Microsoft Exchange Server and sorts each host by whether its OWA build falls below the single CVE-2022-41082 fixed release in the graph. CVE-2022-41082 is ProxyNotShell remote code execution on Exchange when chained with the SSRF path. This check never runs PowerShell, never deserializes a payload, and never claims the 41040 chain. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs /owa/auth/logon.aspx, fingerprints Exchange from OWA markers, parses the version from the /owa/auth/<build>/ path, and compares that tuple to FIXED only at 15.2.1118.21. There is no branch table. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. There is no confirm step and no RCE payload.
Run it on a schedule when Exchange CU lines change. A host that stayed on an older 15.2 build after the Nov 2022 SU is the reason the same fingerprint stays useful.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
GET /owa/auth/logon.aspx on each host and fingerprint Exchange from markers such as /owa/auth/, logon.aspx, Outlook Web App, and X-OWA-Version.
Parse the build from the /owa/auth/<n.n.n.n>/ path and compare it to the single FIXED release 15.2.1118.21 in the graph. No FIXED_BRANCHES table.
Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, vulnerable, and errors.
Inputs
Target scope. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether Exchange was detected, the version read, the vulnerable flag, and detail text.
findings.jsonl. The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
summary.json. Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.
Integrations
HTTP. Unauthenticated GET of /owa/auth/logon.aspx only. No PowerShell remoting and no deserialization probe.
Sample output
The records below are illustrative and do not come from a real run. They show one Exchange host below the CVE-2022-41082 FIXED release, one at or above it, and one host that is not the product.
Hosts whose parsed OWA build is below the single FIXED release 15.2.1118.21 (Exchange 2019 CU12 Nov 2022 SU). The graph has no FIXED_BRANCHES table, so triage is not branch-aware. The compare uses the OWA path version on /owa/auth/logon.aspx.
Does an affected row mean RCE ran?
No. The check only GETs /owa/auth/logon.aspx and reads the OWA version path. It does not run PowerShell, does not deserialize a payload, and does not claim a 41040 chain.
Is this check safe on production?
Yes. It is a read-only unauthenticated GET of the public OWA logon page. It does not log in or execute code.
Does the check need credentials?
No. It fingerprints the public OWA logon page the way an external scanner would.
What is CVE-2022-41082?
ProxyNotShell remote code execution in Microsoft Exchange Server when chained with SSRF. This workflow maps hosts to that CVE by OWA version exposure only against a single FIXED release.