Full Report
On-prem Microsoft Exchange Server vulnerabilities are being actively exploited in the wild. Read our blog for Huntress' most up-to-date research and IOCs.
Analysis Summary
# Vulnerability: Mass Exploitation of On-Prem Microsoft Exchange Servers (ProxyLogon & April 2021 Updates)
## CVE Details
* **CVE ID:** CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065 (Collectively known as **ProxyLogon**), plus additional April 2021 CVEs (unspecified in text but noted as critical RCE).
* **CVSS Score:** 9.8 (Estimated for ProxyLogon chain)
* **Severity:** Critical
* **CWE:** CWE-918 (Server-Side Request Forgery), CWE-502 (Deserialization of Untrusted Data), CWE-434 (Unrestricted Upload of File with Dangerous Type)
## Affected Systems
* **Products:** Microsoft Exchange Server (On-premises)
* **Versions:** 2013, 2016, and 2019
* **Configurations:** Servers must be on-premises and reachable via Port 443 (HTTPS). Cloud-based Exchange Online (Microsoft 365) is not affected.
## Vulnerability Description
The primary threat involves a chain of four zero-day vulnerabilities. It begins with **CVE-2021-26855**, a Server-Side Request Forgery (SSRF) flaw that allows an unauthenticated attacker to bypass authentication and act as the Exchange server. By combining this with other flaws, attackers can bypass security controls to perform insecure deserialization and write files to the system. This allows for the deployment of webshells, which provide persistent remote access to the underlying operating system.
## Exploitation
* **Status:** Exploited in the wild (Mass exploitation confirmed).
* **Complexity:** Low (Automated exploitation tools and PoCs are widely available).
* **Attack Vector:** Network (Remote)
## Impact
* **Confidentiality:** Total (Unauthorized access to all emails and sensitive data).
* **Integrity:** Total (Ability to deploy webshells, Cobalt Strike, and Mimikatz).
* **Availability:** Total (Potential for ransomware or system shutdown).
## Remediation
### Patches
* **Microsoft Emergency Patches:** Apply updates specific to your Cumulative Update (CU) level immediately.
* **April 2021 Updates:** Additional critical security updates were released to address further RCE vulnerabilities.
* **Wizard Tool:** Use the [Microsoft Exchange Update Wizard](https://aka[.]ms/ExchangeUpdateWizard) to identify the correct path.
### Workarounds
* Microsoft released an **official NSE script** and an **Exchange On-Premises Mitigation Tool (EOMT)** for organizations unable to patch immediately, though patching remains the only permanent fix.
## Detection
* **Indicators of Compromise (IOCs):**
* Presence of webshells in Exchange web directories (e.g., `/aspnet_client/system_web/`).
* Evidence of `LSASS` dumps via Mimikatz.
* Unauthorized usage of PowerShell for data exfiltration.
* **Detection Methods:**
* Run the **Microsoft-provided PowerShell scripts** (`Test-ProxyLogon.ps1`) to check for exploitation evidence in HttpsProxy logs.
* Monitor for unusual child processes spawning from `w3wp.exe` (IIS worker process) or `UMWorkerProcess.exe`.
* Huntress confirmed findings of Cobalt Strike beacons on compromised hosts.
## References
* [Microsoft Security Blog - HAFNIUM Targeting Exchange](https://www[.]microsoft[.]com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/)
* [Microsoft MSRC - Multiple Security Updates Released](https://msrc-blog[.]microsoft[.]com/2021/03/02/multiple-security-updates-released-for-exchange-server/)
* [Huntress Blog - ProxyShell vs. ProxyLogon](https://www[.]huntress[.]com/blog/proxyshell-vs-proxylogon-whats-the-difference)