^{CVE-2021-27065:}Microsoft Exchange Server Post-Authentication Arbitrary File Write Vulnerability (ProxyLogon)

Overview

This vulnerability affects Microsoft Exchange Server and is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The vulnerability allows an authenticated attacker to write files to arbitrary locations on the server. It is part of a chain of vulnerabilities known collectively as ProxyLogon, which has been actively exploited in the wild.

The vulnerability exists in the Unified Messaging service of Exchange Server. By sending specially crafted requests, an attacker can write files to any path on the server. This can be leveraged to write web shells or other malicious code that can be executed on the server, leading to complete system compromise.

Affected products include:

• Microsoft Exchange Server 2013
• Microsoft Exchange Server 2016
• Microsoft Exchange Server 2019

Remediation

1. Apply the security updates released by Microsoft immediately. Microsoft has released out-of-band security updates for all affected versions of Exchange Server.

2. If you cannot apply patches immediately, implement the following mitigations:

   • Restrict untrusted connections to Exchange Server
   • Use a firewall to prevent external access to Exchange Server ports 443, 80, 25, and 465
   • Disconnect vulnerable Exchange servers from the internet

3. Check for indicators of compromise:

   • Look for web shells in the following paths:
     • C:\inetpub\wwwroot\aspnet_client\
     • C:\inetpub\wwwroot\aspnet_client\system_web\
     • The Exchange Server installation path
   • Check for suspicious files with extensions like .aspx, .ashx, .asmx, or .php

4. If compromise is suspected, consider:

   • Rebuilding Exchange servers from known good sources
   • Resetting credentials for any accounts with administrative access to Exchange
   • Conducting a full security audit of your environment

References

1. Microsoft Security Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-27065
2. ProxyLogon Remote Code Execution Exploit: http://packetstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.html
3. ProxyLogon Collector Tool: http://packetstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.html
4. Microsoft Security Blog on Exchange Server Vulnerabilities: https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/
5. CISA Alert on Exchange Server Vulnerabilities: https://us-cert.cisa.gov/ncas/alerts/aa21-062a