Quick links
Press Enter to search, Esc to close
Exploited vulnerability
A flaw in on-premises Microsoft Exchange Server, the first link in the attack chain called ProxyLogon.
In short
CVE-2021-26855 is a flaw in on-premises Microsoft Exchange Server, the first link in the attack chain called ProxyLogon. Per CISA, an outsider with no login can send requests and act as the Exchange server itself. The US Government attributed the activity to China's Ministry of State Security.
Server-side request forgery means tricking a server into sending requests on the attacker's behalf. CISA says this lets an unauthenticated attacker send arbitrary HTTP requests, authenticate as the Exchange Server, and read mailboxes and sensitive information. Chained with a related flaw (CVE-2021-27065), which lets an authenticated attacker write a file anywhere on the server, it leads to code running on the server.
CISA says on-premises Exchange Server 2013, 2016 and 2019 are affected. The flaws are not known to affect Exchange Online or Microsoft 365 cloud email. Check Microsoft's own update guide for the exact fixed builds, because this page could not open that page.
NVD published the record in March 2021 (3 March), after Microsoft released out-of-band patches, meaning updates issued outside the normal monthly cycle. CISA's alert AA21-062A covers the flaws. On 19 July 2021 it was updated to say the US Government attributes the activity to actors affiliated with China's Ministry of State Security. CISA also issued Emergency Directive 21-02 to US federal agencies.
CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 3 November 2021, and the KEV entry flags known ransomware use. CISA's alert notes that Microsoft reported DearCry ransomware being used against compromised on-premises Exchange servers.
NVD record and CISA directive. NVD publishes CVE-2021-26855 after Microsoft released out-of-band patches. CISA issues alert AA21-062A and Emergency Directive 21-02 to US federal agencies the same day.
US attribution. CISA updates AA21-062A to say the US Government attributes the activity to actors affiliated with China's Ministry of State Security.
Added to CISA KEV. CISA adds the flaw to the KEV catalog; the entry flags known ransomware use.
The KEV entry says to apply updates per vendor instructions. Move off versions that Microsoft no longer supports.
CISA says to search for aspx files in the paths its alert lists, such as the aspnet_client folder and the Exchange FrontEnd ecp auth folder, because attackers leave web shells (small remote-control scripts) there.
CISA says an organization that finds exploitation should assume network identity compromise and respond to that, not only to the server.
CISA's Emergency Directive 21-02 requires security and cumulative updates on Exchange servers within 48 hours of release for US federal agencies. It is a good benchmark for any organization.
It is part of the same chain and is also in the KEV catalog. Make sure the Microsoft updates you install cover both.
ProxyLogon is the name for an attack chain that starts with CVE-2021-26855, a server-side request forgery flaw in on-premises Microsoft Exchange Server. An outsider with no login can send requests and act as the Exchange server.
CISA says on-premises Exchange Server 2013, 2016 and 2019 are affected. The flaws are not known to affect Exchange Online or Microsoft 365 cloud email.
The CISA Known Exploited Vulnerabilities entry flags known ransomware use. CISA's alert notes that Microsoft reported DearCry ransomware being used against compromised on-premises Exchange servers.
On 19 July 2021 CISA updated its alert AA21-062A to say the US Government attributes the activity to actors affiliated with China's Ministry of State Security.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.
