Full Report
Attackers are scanning for vulnerable Microsoft Exchange servers and abusing the latest line of Exchange vulnerabilities that were patched in early 2021.
Analysis Summary
# Vulnerability: ProxyShell Exploit Chain in Microsoft Exchange
## CVE Details
- **CVE ID:**
- **CVE-2021-34473**: Pre-auth Path Confusion vulnerability (Remote Code Execution)
- **CVE-2021-34523**: Elevation of Privilege vulnerability
- **CVE-2021-31207**: Post-auth Arbitrary File Write (Security Feature Bypass)
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-287 (Improper Authentication), CWE-269 (Improper Privilege Management)
## Affected Systems
- **Products:** Microsoft Exchange Server
- **Versions:** 2013, 2016, and 2019
- **Configurations:** On-premises installations. (Exchange Online/Office 365 is not affected). Servers that have not applied the May or July 2021 Cumulative Updates are vulnerable.
## Vulnerability Description
ProxyShell is an exploit chain that allows an unauthenticated attacker to execute arbitrary code remotely via port 443. The chain functions by:
1. **CVE-2021-34473:** Leveraging a path confusion flaw to bypass authentication by communicating with the Exchange PowerShell backend.
2. **CVE-2021-34523:** Escalating privileges to SYSTEM/Administrator level.
3. **CVE-2021-31207:** Using the "Mailbox Import/Export" feature to write a malicious webshell (often disguised as a `.aspx` file) to the server's web-accessible directories.
## Exploitation
- **Status:** Exploited in the wild (Mass exploitation and scanning observed); PoC available.
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** Total (Full access to all mailboxes and data)
- **Integrity:** Total (Ability to modify system files and configurations)
- **Availability:** Total (Potential for ransomware deployment, such as LockBit)
## Remediation
### Patches
- Microsoft released official patches to address these vulnerabilities in the **April 2021** and **May 2021** security updates.
- Administrators should ensure they are running the latest Cumulative Update (CU) and Security Update (SU) for their specific version of Exchange.
### Workarounds
- Block port 443 at the firewall for untrusted external traffic if patching cannot be performed immediately (note: this will break remote mail access).
- Disable the Exchange PowerShell backend if not required.
## Detection
- **Indicators of Compromise (IoCs):**
- Presence of unexpected `.aspx` files in `C:\inetpub\wwwroot\aspnet_client\` or Exchange installation paths.
- Unusual modifications to `applicationHost.config` or `MSExchangeECPAppPool.config`.
- **Known Web Shell Paths:** Check for physical paths defined in virtual directories within IIS configurations that point to non-standard locations.
- **Detection methods and tools:**
- Monitor IIS logs for requests to `/autodiscover/autodiscover.json` or `/powershell`.
- Use Microsoft’s "Exchange On-premises Mitigation Tool" (EOMT) or specialized scripts to scan for webshells.
## References
- [Microsoft Security Update Guide] hxxps[://]msrc[.]microsoft[.]com/update-guide/vulnerability
- [Huntress Blog: ProxyShell vs ProxyLogon] hxxps[://]www[.]huntress[.]com/blog/proxyshell-vs-proxylogon-whats-the-difference
- [CISA Alert on ProxyShell] hxxps[://]www[.]cisa[.]gov/news-events/alerts/2021/08/21/microsoft-exchange-vulnerabilities-being-exploited-proxyshell