CVE 2023 23397script Doc

CVE-2023-23397.ps1 is a script that checks Exchange messaging items (mail, calendar and tasks) to see whether a property is populated with a non empty string value. It is up to the admin to determine if the value is malicious or not. If required, admins can use this script to clean up the property for items that are malicious or even delete the items permanently. Please see CVE-2023-23397 for more information.

There are two modes for the script: Audit and Cleanup.

Audit Mode: Script provides a CSV file with details of items that have the property populated.

Cleanup Mode: Script performs cleanup on detected items by either clearing the property or deleting the item.

Run the script in audit mode.

For organizations with large number of mailboxes: It is recommended to break up the mailbox list into multiple files, so the script can be run against mailboxes in batches. Here is an example of how to break up the mailboxes into batches of 1000:

If the script execution finishes with "No vulnerable item found", no further action is required.

To run this script in an on-premises Exchange Server environment, you need to use an account with the ApplicationImpersonation management role. You can create a new role group with the required permissions by running the following PowerShell command in an elevated Exchange Management Shell (EMS):

New-RoleGroup -Name "CVE-2023-23397-Script" -Roles "ApplicationImpersonation" -Description "Permission to run the CVE-2023-23397 script" Add-RoleGroupMember -Identity "CVE-2023-23397-Script" -Member " " The script uses Exchange Web Services (EWS) to fetch items from user mailboxes. So, the machine on which the script is run should be able to make EWS calls to your Exchange server.

You can also create a new Throttling Policy to prevent the user who runs the script from being throttled. Make sure to revert the throttling policy after you're done running the script.

Please note that this is for Exchange on-premises environments only.

To run this script in an Exchange Online environment, you need to be a Global Administrator or an Application Administrator . The script will create an application with full access permission on all the mailboxes.

Furthermore it is possible to use a certificate to run the script in Audit and Cleanup mode. This is called Certificate Based Authentication (CBA) . The steps are outlined in the FAQ section .

NOTE: The script uses Microsoft.Exchange.WebServices.dll to make EWS calls. The script will try to download the DLL and use it. However, if it is unable to, you will need to download the DLL and specify the path.

The script accepts the following parameters:

You can use the AzureEnvironment parameter to specify the cloud against which the script runs. By default, the script will run against the Global (worldwide) service. Supported values are:

Execute the script in audit mode as an admin with the ApplicationImpersonation management role. For scanning on-premises mailboxes, the Environment value should be "Onprem" and you should provide the EWS URL of your Exchange server in EWSServerURL property. The script will ask for a login prompt, and the username must be provided.

The username which is passed to the script, must be specified in the UPN format where the domain-part is a domain accepted by the Exchange Server.

Optionally, you can use the Credential flag to provide admin credentials in PSCredential format. Set the EWSServerURL parameter to specify the EWS URL if the Autodiscover call fails.

This syntax runs the script to audit all the mailboxes.

Note: If there are Exchange 2013 servers in the environment with Exchange 2016 or 2019, the script may not be able to open mailboxes on Exchange 2013 and may give the following error:

If the above error appears, run the script with an additional parameter EWSExchange2013, as shown below.

This syntax runs the script to audit all mailboxes for items that were created during a specific period.

The script provides a list of all the messages containing the problematic property in the mailboxes of users specified in an AuditResult_timestamp.CSV file. Admins should analyze this file and mark (with a "Y") messages for which either the property is to be cleaned or the message must be removed.

Step 1 Mark the messages for cleanup by entering "Y" instead of "N" in the cleanup column of CSV file.

Step 2 Choose either to remove the message or only the problematic property in the step by specifying CleanupAction as "ClearItem" or "ClearProperty." Execute the script as follows to remove the message or property marked with Y in the CSV file.

This syntax runs the script to clear the problematic property from messages:

This syntax runs the script to delete messages containing the malicious property

First, execute the script in Audit mode as an admin with Global Administrator or Application Administrator role. For scanning online mailboxes, the Environment parameter should be "Online."

While scanning Exchange Online mailboxes, the script needs an Azure AD app that has delegate permissions for all Exchange Online mailboxes. You can create the application using the script. And once the application is no longer required, you can delete the application using the script as well.

This syntax runs the script to create an Azure application

This syntax runs the script to delete the Azure application created by the script

This syntax runs the script to Audit all mailboxes in Exchange Online.

NOTE: Connect to EXO with Exchange Online PowerShell session

This syntax runs the script to Audit all mailboxes for items that were during a specific period.

This syntax runs the script to Audit all mailboxes by using a certificate to authenticate and using the improved SearchFolder functionality.

This syntax runs the script to clear the problematic property from messages.

This syntax runs the script to delete messages containing the problematic property.

This syntax runs the script to delete messages containing the problematic property. It uses a certificate to acquire the required tokens.

If there are Exchange 2013 servers in an environment with Exchange 2016 or Exchange 2019, the script may not be able to open mailboxes on Exchange 2013 and may give the following error:

If the above error appears, run the script with the EWSExchange2013 parameter:

If Autodiscover fails due to a redirection error and the above error appears, provide the EWS URL using the EWSServerURL parameter.

While running the script in Exchange Online, you might see the above error intermittently. Re-running the script should resolve the issue. If it occurs frequently, then remove the Azure application you have created using -DeleteAzureApplication parameter and then recreate it using -CreateAzureApplication parameter.

Incorrect link was provided to download Microsoft.Exchange.WebServices.dll originally that is causing this issue. Follow these steps to correct this problem.

You are getting a 401 unauthorized when trying to provide the -EWSServerURL parameter to the script. The possible causes can be due to bad credentials provided or the URL endpoint is not working correctly. Try to provide the credentials again to start off with. If that doesn't work, does the URL work when using a browser? You should get a result like this:

If you don't get a response looking like this after you are prompted for a username and password, then this could be the problem. Try to see if either the FQDN, , or works instead. If one of those do, use that instead for the -EWSServerURL parameter.

NOTE: Make sure to include -IgnoreCertificateMismatch if using localhost or 127.0.0.1