ProxyShell
- Product
- Microsoft Exchange Server 2013 / 2016 / 2019
- CVE
- CVE-2021-34473CVE-2021-34523CVE-2021-31207
- Disclosed
- 2021-08-05
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- On-premises Exchange Server 2013, 2016, 2019 without the April/May 2021 security updates
- Fixed
- April 2021 (CVE-2021-34473, -34523) and May 2021 (CVE-2021-31207) security updates
Summary
Orange Tsai's second Exchange chain, shown at Pwn2Own 2021 and Black Hat USA 2021. A URL path confusion in the Autodiscover front end gives pre-auth access to back-end endpoints, an EoP lets the attacker act as any user in the Exchange PowerShell backend, and a mailbox-export trick writes a web shell. Mass exploitation began within days of the talk.
Root cause
Exchange's explicit-logon URL normalization removed a substring from the path based on the Email parameter, so a crafted /autodiscover/autodiscover.json?@... URL reached arbitrary back-end paths as SYSTEM (CVE-2021-34473). The PowerShell backend accepted an X-Rps-CAT token supplied in the URL to impersonate any user, including administrators (CVE-2021-34523). New-MailboxExportRequest could then export an attacker-crafted email to a .aspx path in the web root, giving a web shell (CVE-2021-31207).
Impact
Unauthenticated RCE as SYSTEM on exposed Exchange servers; heavily used by ransomware groups (LockFile, Conti affiliates) in 2021.
Detection
IIS logs with autodiscover.json requests containing '@' and paths to /mapi/nspi or /powershell; New-MailboxExportRequest / New-ManagementRoleAssignment in MSExchange Management logs; .aspx files appearing in web directories. Nuclei template CVE-2021-34473.
Mitigation
Install current Exchange CUs and security updates, and restrict internet exposure of Exchange; hunt for web shells and export requests.