ProxyLogon
- Product
- Microsoft Exchange Server 2013 / 2016 / 2019
- CVE
- CVE-2021-26855CVE-2021-26857CVE-2021-26858CVE-2021-27065
- Disclosed
- 2021-03-02
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- On-premises Exchange Server 2013, 2016, 2019 (and 2010 for CVE-2021-26857) before the March 2021 security updates
- Fixed
- March 2, 2021 out-of-band security updates (e.g. KB5000871) on supported CUs
Summary
A pre-auth server-side request forgery in Exchange's front-end proxy let attackers authenticate to the back end as the Exchange server itself, then chain a post-auth arbitrary file write to drop a web shell. Found by Orange Tsai (DEVCORE), it was exploited as a zero-day by HAFNIUM and then by many groups, compromising tens of thousands of servers.
Root cause
The Client Access front end used a cookie (X-BEResource) to decide which back-end server to proxy a request to, and attackers could point it at arbitrary URLs, getting a request authenticated as the machine account (CVE-2021-26855). With that access, attackers could abuse ECP's OAB virtual-directory settings to write a file to an arbitrary path (CVE-2021-27065 / -26858), creating an ASPX web shell; CVE-2021-26857 was an insecure deserialization in the Unified Messaging service.
Impact
Unauthenticated RCE as SYSTEM on Exchange, mailbox theft, and persistent web shells.
Detection
Run Microsoft's Test-ProxyLogon.ps1 / EOMT. Look for X-BEResource / X-AnonResource-Backend cookies in IIS logs, new .aspx files under the OAB, owa/auth and ecp directories, and Set-OabVirtualDirectory events in ECP logs. Nuclei template CVE-2021-26855.
Mitigation
Apply the March 2021 (or later) Exchange security updates on a supported CU, then hunt for web shells, since patching does not remove existing compromise.