Microsoft · Exchange Server
Microsoft Exchange Server contains a remote code execution vulnerability classified as Server-Side Request Forgery (CWE), which lies in the server's handling of request processing. An unauthenticated attacker with network access to the Exchange Server can exploit it without any user interaction or non-default configuration, potentially gaining high confidentiality and integrity impact on the affected system.
First seen exploited 47 days after disclosure. Public exploit code (Metasploit) was available 3 months before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
This is a remote code execution vulnerability that is often chained with CVE-2021-34523, a privilege escalation vulnerability.
distributing phishing emails with malicious attachments [T1566.001] and by exploiting the following vulnerabilities against Microsoft Exchange servers [T1190]: CVE-2021-31207 - Microsoft Exchange Server Security Feature Bypass Vulnerability CVE-2021-34473 - Microsoft Exchange Server Remote Code Execution
BlackByte ransomware threat actors exploit ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) found in Microsoft Exchange Server to gain initial access to the target network.
Tactic;Technique;Description TA0001 Initial Access;T1190 Exploit Public-Facing Application;In a number of attacks, the threat actors used ProxyShell vulnerablilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).
CVE-2021-34473 is a part of the ProxyShell vulnerabilities in Microsoft Exchange and CVE-2021-34473 is a code execution vulnerability that requires no user action or privileges to exploit.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2021-34473 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
To obtain initial access into the victim’s environment, the threat actor was observed exploiting the ProxyShell vulnerabilities CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207 on unpatched Microsoft Exchange Servers.
Tactic;Technique;Description TA0001 Initial Access;T1190 Exploit Public-Facing Application;In a number of attacks, the threat actors used ProxyShell vulnerablilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207).
BlackByte ransomware threat actors exploit ProxyShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) found in Microsoft Exchange Server to gain initial access to the target network.
2 passages name itOriginal (opens in a new tab) ↗
In recent BlackByte attacks investigated by Symantec, the attackers exploited the ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) vulnerabilities in Microsoft Exchange Servers to gain initial access.
…distributing phishing emails with malicious attachments [T1566.001] and by exploiting the following vulnerabilities against Microsoft Exchange servers [T1190]: CVE-2021-31207 - Microsoft Exchange Server Security Feature Bypass Vulnerability CVE-2021-34473 - Microsoft Exchange Server Remote Code Execution…
2 passages name itOriginal (opens in a new tab) ↗
Vulnerabilities such as ProxyShell (CVE-2021-34473) and improper SQL sanitization (CVE-2021-20028) have been observed being utilized as footholds into the environment.
Mentions the CVE; no further detail.
Mentions the CVE; no further detail.
Mentions the CVE; no further detail.
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.