How to Shield Your Exchange Server Against the Latest XSS Zero-Day Attacks

Introduction

In late 2023, Microsoft disclosed a critical zero-day vulnerability affecting Exchange Server that attackers are actively exploiting. The flaw, a high-severity cross-site scripting (XSS) issue, allows threat actors to execute arbitrary code when a user opens a malicious email in Outlook on the Web (OWA). This guide walks you through the steps to protect your organization—from applying Microsoft's official mitigations to verifying your systems aren't already compromised.

What You Need

• Administrative access to your Exchange Server environment (on-premises or hybrid)
• PowerShell version 5.1 or later with Exchange Management Shell
• Latest Microsoft security advisory (KB number) for the specific zero-day
• Backup of your Exchange Server and critical data
• Access to security logs (Event Viewer, IIS logs, or SIEM tool)
• Optional: Third-party web application firewall (WAF) or email security gateway

Step-by-Step Mitigation Guide

Step 1: Identify Affected Exchange Versions

First, determine whether your Exchange Server is running a vulnerable build. The zero-day affects Exchange Server 2019, 2016, and 2013 cumulative updates prior to the patch released in March 2023 (and later discovered to be incomplete, leading to this new advisory). Run the following PowerShell command to check your version:

Get-ExchangeServer | Format-List Name, AdminDisplayVersion

If your version is earlier than Exchange 2019 CU12, Exchange 2016 CU23, or Exchange 2013 CU23, you are at risk. Record the exact build number for reference.

Step 2: Apply Microsoft's Official Mitigation

Microsoft has released a URL rewrite rule that blocks the exploit vector. This mitigation does not require a restart and can be applied via the Exchange Admin Center (EAC) or manually by editing the web.config file. For EAC users:

1. Open the Exchange Admin Center.
2. Navigate to Servers > Virtual Directories.
3. Select the OWA virtual directory (usually named owa (Default Web Site)).
4. In the properties pane, click URL Rewrite.
5. Import the rule provided in the Microsoft advisory. Save changes.

For manual application, add the rewrite rule to %ExchangeInstallPath%\ClientAccess\Owa\Web.config within the <system.webServer><rewrite><rules> section. The exact XML snippet is available in the advisory KB article.

Step 3: Verify Mitigation Applied Successfully

After applying the rule, test the mitigation by simulating the attack vector. Use a tool like curl or a browser to send a crafted request to your OWA endpoint. For example:

curl -v "https://your-exchangeserver.com/owa/" -H "Cookie: X-BEResource=...;" -H "User-Agent: ..."

The expected result is a 404 or 500 error when the malicious pattern is present. Confirm that legitimate OWA traffic still works—users should be able to log in and read email normally.

Step 4: Check for Signs of Compromise

Because this zero-day is already under active exploitation, it's critical to audit your environment. Look for these indicators:

• Unusual entries in IIS logs: requests containing __VIEWSTATE or encoded JavaScript in query strings targeting /owa/ or /ecp/.
• WinEvent ID 4625 (failed logons) from unexpected IPs.
• PowerShell scripts executed on the server by non-admin accounts.
• New scheduled tasks or suspicious services.

Run a scan using Microsoft's Exchange Server Health Checker script:

Invoke-Expression ((New-Object System.Net.WebClient).DownloadString('https://aka.ms/exhealthcheck'))

Review the output for vulnerabilities and suspicious configurations.

Step 5: Apply Additional Security Layers

While the URL rewrite rule stops the exploit, consider hardening your environment further:

1. Implement a Web Application Firewall (WAF)—Azure WAF or a third-party solution can block XSS payloads before they reach Exchange.
2. Enable Multi-Factor Authentication (MFA) for all OWA users to reduce impact even if credentials are stolen.
3. Restrict OWA access to internal IP ranges or VPN if external access isn't required.
4. Monitor for CVE-2023-36756 and related patches—keep Exchange Server up to date with the latest cumulative updates once Microsoft releases a permanent fix.

Tips for Ongoing Protection

• Automate updates: subscribe to the Microsoft Security Response Center (MSRC) email alerts and use a patch management solution to deploy Exchange updates within 24–48 hours of release.
• Audit regularly: schedule monthly penetration tests or vulnerability scans focusing on OWA and ECP endpoints.
• Educate users: train staff to recognize phishing emails that may attempt to exploit XSS vulnerabilities. Encourage reporting suspicious messages.
• Backup and recovery: maintain offline backups of critical Exchange data, and practice restoring from backup to ensure business continuity in case of ransomware or destructive attacks.
• Consult Microsoft's guidance: the advisory for this zero-day includes additional registry keys and PowerShell commands—refer to the official article for any late-breaking changes.