Microsoft Exchange Server ProxyLogon vulnerability

Added: 03/19/2021

Background

Microsoft Exchange is an e-mail server for Microsoft Windows operating systems.

Problem

A server-side request forgery vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary commands.

Resolution

Apply the patch referenced in Microsoft Advisory CVE-2021-26855.

References

<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855&gt;
<https://proxylogon.com/&gt;

Limitations

Exploit requires knowledge of an e-mail address on the target mail server.

Exploit creates a web shell in \Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\test11.aspx which must be manually removed after a successful exploit.

Platforms

Windows