Microsoft Exchange Server Unpublished Pre-Authentication Remote Code Execution Exploit

2021-07-2200:00:00

liver

0day.today

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.044 Low

EPSS

Percentile

92.3%

JSON

[Description]
First, IT’S NOT PROXYLOGON. IT’S NOT PROXYLOGON. IT’S NOT PROXYLOGON.
It’s an unpublished vulnerability found by myself. It’s not exploited in the wild and there’s no exploit code on the Internet.
[About The Vulnerability]
It’s a exploit chain utilizing pre-auth SSRF + post-auth EoP + post-auth file write to achieve pre-auth RCE on Exchange Server. The corresponding CVE numbers are:

CVE-2021-28480, CVSS score 10
CVE-2021-28481, CVSS score 10
CVE-2021-28482, CVSS score 9
This exploit chain is not memory corruption bug so it’s stable, easy to use, and no privilege required, the only limit is you must provide one victim’s email as argument.
[Affect Versions]
Exchange Server 2019 < 15.02.0858.010
Exchange Server 2019 < 15.02.0792.013
Exchange Server 2016 < 15.01.2242.008
Exchange Server 2016 < 15.01.2176.012
Exchange Server 2013 < 15.00.1497.015
Video: https://0day.today/videos/36585.mp4