Expert released PoC code for Microsoft Exchange CVE-2021
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-42321 | Authenticated RCE via Insecure Deserialization in Microsoft Exchange Server CVE-2021-42321 is an insecure deserialization remote code execution flaw in on-premises Microsoft Exchange Server, tied to insufficient validation by Exchange's ChainedSerializationBinder. Per the CVSS vector, it is triggered over the network by an authenticated user with low privileges and no user interaction, by submitting crafted serialized data that Exchange fails to safely deserialize. A successful attacker gains arbitrary code execution on the Exchange server with high impact to confidentiality, integrity, and availability, giving a foothold in the mail environment. Organizations running affected on-premises Exchange deployments are in scope. The flaw was actively exploited before patches shipped in November 2021, has public PoC exploits, was added to CISA's KEV on 2021-11-17 with known ransomware use, and carries an EPSS of 91.7% (99.9+ percentile). Do: Apply the November 2021 Microsoft Exchange Server security updates per vendor instructions to affected on-premises Exchange 2016/2019 deployments. Given confirmed in-the-wild exploitation and known ransomware use, check Exchange servers for signs of compromise, verify backups, and review accounts holding privileged Exchange roles, since exploitation requires authenticated access — enforce MFA and audit impersonation/admin role assignments while patching. | 8.8 | 92% | KEV ransomware PoC ×2 |
| masshundreds of thousands of internet-facing on-premises Exchange servers (on the order of 10^5 endpoints, supporting millions of mailbox users) |
Full article369 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 23, 2021
A researcher has released a proof-of-concept exploit code for an actively exploited vulnerability affecting Microsoft Exchange servers.
The researcher Janggggg has published on Sunday a proof-of-concept exploit code for an actively exploited vulnerability, tracked as CVE-2021-42321, in Microsoft Exchange servers.
The CVE-2021-42321 is a high-severity remote code execution issue that occurs due to improper validation of cmdlet arguments. Microsoft pointed out that the flaw can be exploited only by an authenticated attacker.
Microsoft addressed the flaw with the release of Microsoft Patch Tuesday security updates for November 2021, the vulnerability impacts on-premises Exchange Server 2016 and Exchange Server 2019.
“We are aware of limited targeted attacks in the wild using one of vulnerabilities (CVE-2021-42321), which is a post-authentication vulnerability in Exchange 2016 and 2019. Our recommendation is to install these updates immediately to protect your environment.” read the announcement published by Microsoft. “These vulnerabilities affect on-premises Microsoft Exchange Server, including servers used by customers in Exchange Hybrid mode. Exchange Online customers are already protected and do not need to take any action.”
“As many ppl requested, Here is the PoC of CVE-2021-42321, Exchange Post-Auth RCE This PoC just pop mspaint.exe on the target, can be use to recognize the signature pattern of a successful attack event” wrote the researcher on Twitter.
According to the FAQ section included in the November 2021 Exchange Server Security Updates users can check if exploit was attempted on their servers before the fix for CVE-2021-42321 was put in place by running the following PowerShell query on their Exchange server to check for specific events in the Event Log:
Get-WinEvent -FilterHashtable @{ LogName='Application'; ProviderName='MSExchange Common'; Level=2 } | Where-Object { $_.Message -like "*BinaryFormatter.Deserialize*" }
There is no time to waste, experts are already observing threat actors scanning the web for vulnerable installs and exploit attempts.
https://twitter.com/GossiTheDog/status/1462831929955438597
In recent months, we observed a large number of attacks aimed at Microsoft Exchange installs carried out by both nation-state actors and financially-motivated attackers, for this reason, it is important to install the latest updates immediately.
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, Microsoft Exchange)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/124917/hacking/microsoft-exchange-cve-2021-42321-rce-poc.html