A chain of Exchange Server flaws let attackers take over mail servers without a password. Lessons for anyone still running Exchange on-premises.
Publicly disclosed: 2 March 2021
On 2 March 2021 Microsoft released emergency updates for Exchange Server: a chain of four vulnerabilities, later called ProxyLogon, allowed attackers to bypass authentication and run code on the server. Exploitation had already started before the patch, and after publication many groups scanned the internet for unpatched servers and installed web shells.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2021-26855 | Critical, CVSS 9.1 (SSRF, authentication bypass) | Exchange Server 2013, 2016, 2019 | Security updates of March 2021 |
CVE-2021-26857, -26858, -27065 | High (code execution, file write) | Exchange Server 2013, 2016, 2019 | Security updates of March 2021 |
Many servers were compromised in the days between disclosure and patching. Installing the update did not remove web shells already planted by attackers, so patched servers could still be under control of intruders.
.aspx files, new accounts, mailbox export requests.Patching closes the door. Checking for compromise finds out who already came in.
Sources: Microsoft Security Blog, NVD CVE-2021-26855.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.