---
title: "Exchange ProxyNotShell RCE (CVE-2022-41082)"
canonical: https://trickest.com/library/cve-2022-41082-exchange-proxynotshell-rce
description: "Flag Microsoft Exchange hosts for CVE-2022-41082 by reading the OWA version path on GET /owa/auth/logon.aspx. Fixed only at 15.2.1118.21. No RCE."
---

# Exchange ProxyNotShell RCE (CVE-2022-41082)

## Overview

This workflow finds Microsoft Exchange Server and sorts each host by whether its OWA build falls below the single CVE-2022-41082 fixed release in the graph. CVE-2022-41082 is ProxyNotShell remote code execution on Exchange when chained with the SSRF path. This check never runs PowerShell, never deserializes a payload, and never claims the 41040 chain. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/owa/auth/logon.aspx`, fingerprints Exchange from OWA markers, parses the version from the `/owa/auth/<build>/` path, and compares that tuple to FIXED only at 15.2.1118.21. There is no branch table. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). There is no confirm step and no RCE payload.

Run it on a schedule when Exchange CU lines change. A host that stayed on an older 15.2 build after the Nov 2022 SU is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/owa/auth/logon.aspx` on each host and fingerprint Exchange from markers such as `/owa/auth/`, `logon.aspx`, Outlook Web App, and `X-OWA-Version`.
3. Parse the build from the `/owa/auth/<n.n.n.n>/` path and compare it to the single FIXED release 15.2.1118.21 in the graph. No FIXED_BRANCHES table.
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Exchange was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/owa/auth/logon.aspx` only. No PowerShell remoting and no deserialization probe.

## Sample output

The records below are illustrative and do not come from a real run. They show one Exchange host below the CVE-2022-41082 FIXED release, one at or above it, and one host that is not the product.

```jsonl
{"url": "https://mail.example.com", "is_product": true, "product_version": "15.2.1118.15", "vulnerable": true, "detail": "below fixed release 15.2.1118.21"}
{"url": "https://mail.example.org", "is_product": true, "product_version": "15.2.1118.21", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Microsoft Exchange Server"}
```

```json
{"cve": "CVE-2022-41082", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which Exchange versions does this flag?

Hosts whose parsed OWA build is below the single FIXED release 15.2.1118.21 (Exchange 2019 CU12 Nov 2022 SU). The graph has no FIXED_BRANCHES table, so triage is not branch-aware. The compare uses the OWA path version on `/owa/auth/logon.aspx`.

### Does an affected row mean RCE ran?

No. The check only GETs `/owa/auth/logon.aspx` and reads the OWA version path. It does not run PowerShell, does not deserialize a payload, and does not claim a 41040 chain.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of the public OWA logon page. It does not log in or execute code.

### Does the check need credentials?

No. It fingerprints the public OWA logon page the way an external scanner would.

### What is CVE-2022-41082?

ProxyNotShell remote code execution in Microsoft Exchange Server when chained with SSRF. This workflow maps hosts to that CVE by OWA version exposure only against a single FIXED release.

## Related workflows

- [Exchange ProxyNotShell SSRF (CVE-2022-41040)](/library/cve-2022-41040-exchange-proxynotshell-ssrf). Reach for it when you need the companion ProxyNotShell SSRF fingerprint with 15.0/15.1/15.2 bands.
- [Exchange privilege escalation (CVE-2022-41080)](/library/cve-2022-41080-exchange-privilege-escalation). Reach for it when the next Exchange flag is privilege escalation, not RCE.
- [Exchange deserialization RCE (CVE-2023-21529)](/library/cve-2023-21529-exchange-deserialization-rce). Reach for it when you need the later Exchange deserialization fingerprint.

---
_Markdown source of https://trickest.com/library/cve-2022-41082-exchange-proxynotshell-rce._