Full Report
We clarify the differences between the ProxyShell (August 2021) and the ProxyLogon (March 2021) exploits impacting Microsoft Exchange on-premises servers.
Analysis Summary
# Vulnerability: ProxyShell and ProxyLogon Exploits (Exchange Server RCE)
## CVE Details
**ProxyShell (Chain of 3 CVEs):**
- **CVE ID:** CVE-2021-34473, CVE-2021-34523, CVE-2021-31207
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-918 (SSRF), CWE-706 (Incorrect Admittance), CWE-269 (Improper Privilege Management)
**ProxyLogon (Chain of 4 CVEs):**
- **CVE ID:** CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065
- **CVSS Score:** 9.8 (Critical)
- **CWE:** CWE-918 (SSRF), CWE-502 (Insecure Deserialization), CWE-22 (Path Traversal)
## Affected Systems
- **Products:** Microsoft Exchange Server
- **Versions:** 2013, 2016, and 2019
- **Configurations:** On-premises deployments (Exchange Online/Office 365 are not affected unless in hybrid environments with on-prem servers).
## Vulnerability Description
Both ProxyLogon and ProxyShell are "exploit chains" that allow an unauthenticated attacker to bypass authentication and achieve Remote Code Execution (RCE).
- **ProxyLogon:** Combines a Server-Side Request Forgery (SSRF) flaw to authenticate as the admin with a file-write flaw to drop a web shell.
- **ProxyShell:** A newer chain (disclosed August 2021) that targets the Microsoft Exchange PowerShell Remoting Service. It uses an explicit path-confusion vulnerability to bypass authentication, elevates privileges, and executes arbitrary commands via PowerShell.
## Exploitation
- **Status:** Exploited in the wild (Mass exploitation observed for both).
- **Complexity:** Low (Automated scripts and PoCs are widely available).
- **Attack Vector:** Network (Remote exploitation via Port 443).
## Impact
- **Confidentiality:** High (Total access to email data and active directory info)
- **Integrity:** High (Ability to deploy ransomware and move laterally)
- **Availability:** High (Ability to shut down services or wipe servers)
## Remediation
### Patches
- **ProxyLogon:** Install Microsoft Security Updates released in **March 2021**.
- **ProxyShell:** Install Microsoft Security Updates released in **May 2021 and July 2021**. (Note: The April/May updates contained the fixes, but the July updates provided additional hardening).
### Workarounds
- There are no permanent workarounds that maintain full functionality; patching is the only recommended solution.
- Restrict access to Port 443 (HTTPS) to known IP addresses or via VPN to reduce the attack surface.
## Detection
- **Indicators of Compromise (IoCs):** Presence of web shells in Exchange installation paths (e.g., `\FrontEnd\HttpProxy\owa\auth\`).
- **Detection Methods:**
- Run the Microsoft-provided "Test-ProxyLogon.ps1" script.
- Scan IIS logs for unusual POST requests to `/autodiscover/autodiscover.json` or `/powershell`.
- Monitor for suspicious child processes of `w3wp.exe` (e.g., `cmd.exe` or `powershell.exe`).
## References
- [Huntress Rapid Response: ProxyShell Update] hxxps://www[.]huntress[.]com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit
- [Microsoft Security Advisory (ProxyLogon)] hxxps://msrc[.]microsoft[.]com/update-guide/vulnerability/CVE-2021-26855
- [Black Hat USA 2021 - ProxyLogon is Just the Tip of the Iceberg] hxxps://i[.]blackhat[.]com/USA21/Wednesday-Handouts/us-21-ProxyLogon-Is-Just-The-Tip-Of-The-Iceberg-A-New-Attack-Surface-On-Microsoft-Exchange-Server[.]pdf