Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe
  • Twitter
  • Facebook
  • LinkedIn

ProxyShell: Attackers Actively Scanning for Vulnerable Microsoft Exchange Servers (CVE-2021-34473)

ProxyShell: Attackers Actively Scanning for Vulnerable Microsoft Exchange Servers (CVE-2021-34473)

Three vulnerabilities from DEVCORE researcher Orange Tsai could be chained to achieve unauthenticated remote code execution. Attackers are searching for vulnerable instances to exploit.

Update August 23: The Analysis section has been updated with information about exploitation of this vulnerability chain. Organizations should update immediately.

Background

Last week at the Black Hat USA and DEF CON security conferences, DEVCORE researcher Orange Tsai presented a talk titled “ProxyLogon is Just the Tip of the Iceberg: A New Attack Surface on Microsoft Exchange Server!” In his Black Hat presentation, he walked through three vulnerabilities in Microsoft Exchange Server:

CVE Description CVSSv3 VPR*
CVE-2021-34473 Microsoft Exchange Server Remote Code Execution Vulnerability 9.1 9
CVE-2021-34523 Microsoft Exchange Server Elevation of Privilege Vulnerability 9.0 8.4
CVE-2021-31207 Microsoft Exchange Server Security Feature Bypass Vulnerability 6.6 8.4

Source: Tenable, August 2021

*Please note: Tenable’s Vulnerability Priority Rating (VPR) scores are calculated nightly. This blog post was published on August 9 and reflects VPR at that time.

Orange Tsai is a prolific researcher who has found many high-severity vulnerabilities in a wide range of products. Most relevant is CVE-2021-26855, aka ProxyLogon, which Tsai reported to Microsoft in January (Volexity and Microsoft Threat Intelligence Center also received credit for discovering this vulnerability). Despite this, ProxyLogon was exploited as a zero-day by the threat group HAFNIUM and other advanced persistent threat actors. Even after Microsoft issued an out-of-band patch for ProxyLogon, it continues to be exploited by threat actors for various types of attacks from cryptomining and creating botnets to ransomware.

Analysis

CVE-2021-34473 is a remote code execution vulnerability and the highest rated, receiving a CVSSv3 score of 9.1. CVE-2021-34523 and CVE-2021-31207 were both initially rated as “Exploitation Less Likely” according to Microsoft’s Exploitability Index because of their independent features, but when chained together, they have significant value to attackers. By chaining these vulnerabilities, an attacker could execute arbitrary commands on vulnerable Exchange servers on port 443. Two of the three ProxyShell vulnerabilities, CVE-2021-34473 and CVE-34523, were patched as part of the April 2021 Patch Tuesday release, though Microsoft says they were “inadvertently omitted” from that security update guide. CVE-2021-31207 was patched in May.

Attackers are actively scanning for Exchange Servers vulnerable to ProxyShell

On August 6, security researcher Kevin Beaumont reported attempts to exploit this vulnerability chain in the wild.

Over the following days, several Computer Security Incident Response Teams issued alerts about attackers scanning for vulnerable Microsoft Exchange Servers. Because of how widely exploited the ProxyLogon and other Exchange Server vulnerabilities have been so far this year, we recommend organizations patch immediately. Attackers are already finding vulnerable servers to exploit and it may be prudent to initiate incident response procedures if you know you have unpatched servers on your network.

CISA urges organizations to patch servers

According to Symantec’s Threat Hunter Team and Huntress Labs, attackers continue to scan for and exploit vulnerable Microsoft Exchange servers using this attack chain to deploy the LockFile ransomware. Symantec also reports that the PetitPotam exploit is being used in these attacks to gain access to domain controllers and thereby spread the ransomware across target networks.

In response, the Cybersecurity and Infrastructure Security Agency issued an urgent alert urging organizations to identify and remediate vulnerable servers.

Proof of concept

After Tsai’s presentations last week, two other researchers published their reproduction of Tsai’s work which included more technical details on how to exploit the vulnerability chain. One of the researchers, Jang, also published a proof-of-concept for ProxyLogon earlier this year.

Vendor response

Microsoft has patched all of these vulnerabilities in its April and May Patch Tuesday releases. CVE-2021-34473 and CVE-2021-34523 were patched in April 2021 but Microsoft did not publish advisories until July.

Identifying affected systems

A list of Tenable plugins to identify these vulnerabilities can be found here.

Get more information

Join Tenable's Security Response Team on the Tenable Community.

Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface.

Get a free 30-day trial of Tenable.io Vulnerability Management.

Related Articles

Are You Vulnerable to the Latest Exploits?

Enter your email to receive the latest cyber exposure alerts in your inbox.

Try for Free Buy Now
Tenable.io FREE FOR 30 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now.

Tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now
Try for Free Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year. Full details here.

Try for Free Buy Now

Try Tenable.io Web Application Scanning

FREE FOR 30 DAYS

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try for Free Contact Sales

Try Tenable.io Container Security

FREE FOR 30 DAYS

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Try for Free Contact Sales

Try Tenable Lumin

FREE FOR 30 DAYS

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.