ProxyShell Exploit Chain

ProxyShell is an exploit chain targeting on-premise installations of Microsoft Exchange Server. It was demonstrated by Orange Tsai at Pwn2Own in April 2021 and is comprised of three CVEs that, when chained, allow a remote unauthenticated attacker to execute arbitrary code on vulnerable targets. The three CVEs are CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207.

Details are available in Orange Tsai’s Black Hat USA 2020 talk and follow-on blog series. ProxyShell is being broadly exploited in the wild as of August 12, 2021.

Recent assessments:

ccondon-r7 at August 12, 2021 9:19pm UTC reported:

Check out the Rapid7 analysis for details on the exploit chain. Seems like a lot of the PoC implementations so far are using admin mailboxes, but I’d imagine folks are going to start finding ways around that soon.

Assessed Attacker Value: 5
Assessed Attacker Value: 5Assessed Attacker Value: 4