StatewardStateward
← All vulnerabilities
CRITICALInfraexploited in the wildcurated

CVE-2021-26855

Microsoft Exchange · Microsoft Exchange Server

Summary

ProxyLogon, disclosed on 2 March 2021, was a chain of flaws in on-premises Microsoft Exchange Server that let an unauthenticated attacker take over a mail server completely, then use it to read everyone's email and plant a foothold in the network. China's state-sponsored HAFNIUM group used it as a zero-day for targeted espionage, but the moment Microsoft patched, the exploit became public and a free-for-all began: within days at least ten APT groups were mass-scanning and compromising every unpatched Exchange server they could find, dropping web shells and ransomware. An estimated 250,000 servers were compromised worldwide, including at least 30,000 in the US, in a matter of weeks. It is the case study in how fast a patched vulnerability becomes a worldwide free-for-all, and why internet-facing infrastructure has to be patched in hours, not weeks.

How it worked

ProxyLogon is a chain of flaws, not one. It begins with CVE-2021-26855, a server-side request forgery (SSRF): an unauthenticated attacker sends a crafted request that tricks the Exchange server into making internal requests as itself, in effect letting the attacker authenticate as the Exchange machine account without any credentials. Chained with a post-authentication file-write flaw (CVE-2021-27065), that becomes unauthenticated remote code execution: the attacker writes a web shell, a small malicious .aspx script, onto the server and then runs arbitrary commands through it. The chain had been independently found by two research teams, Volexity (which caught it being exploited in the wild) and DEVCORE's Orange Tsai (who reported it to Microsoft), before HAFNIUM's quiet campaign was uncovered.

From a compromised mail server, the attacker can read all of an organisation's email, harvest credentials, and pivot deeper into the network. No user had to click anything, and no password was needed. The web shell also provided durable access that survived the eventual patch, which is what made the cleanup so painful.

The damage

HAFNIUM, a Chinese state group, used ProxyLogon quietly as a zero-day for espionage first. But when Microsoft shipped the emergency patch on 2 March 2021, defenders and attackers alike reverse-engineered it into a working exploit within days, and a zero-day-turned-public gold rush followed. At least ten APT groups began mass-exploiting; an estimated 250,000 servers were compromised, with around 125,000 still unpatched a week after the fix, and at least 30,000 US organisations, small businesses, schools, and governments running on-premises Exchange, were breached in weeks, many left with web shells they did not know about. Nine days after the patch, the first ProxyLogon ransomware, DearCry, appeared. The response was extraordinary: CISA issued an emergency directive ordering federal agencies to patch or disconnect Exchange, and the FBI obtained a court warrant to reach into hundreds of private US servers and delete the attackers' web shells, notifying the owners afterward, a legal first.

Why ProxyLogon still matters

ProxyLogon is the definitive lesson in the patch gap. The window between a fix shipping and mass exploitation is now measured in hours: attackers reverse the patch to build the exploit, then scan the entire internet. So internet-facing infrastructure, and a mail server is about as juicy as it gets, must be patched on the shortest possible SLA, and you must assume that a public exploit means immediate, indiscriminate scanning. It also shows two patterns that recur: the SSRF-to-RCE chain, and web-shell persistence, the same model the Clop gang used in the MOVEit campaign two years later. And it is a strong argument for moving high-value, internet-facing systems like email off self-managed on-premises servers and onto managed services with a hardened, automatic patch cadence.

How to fix it

  • Patch Exchange immediately with the out-of-band security updates, and treat any server that was internet-facing and unpatched as already compromised.
  • Hunt for web shells (unexpected `.aspx` files in Exchange directories) and other persistence, not just the vulnerability; the patch closes the door but does not evict an attacker already inside.
  • Reset credentials and machine-account secrets and review for lateral movement, since the attacker authenticated as the server and could pivot.

How to avoid it

  • Patch internet-facing infrastructure on the shortest possible SLA; once a patch ships, attackers reverse it into a working exploit within hours and scan the whole internet.
  • Reduce attack surface: do not expose mail servers and admin interfaces to the internet when a gateway, VPN, or managed service can sit in front.
  • After any critical CVE in internet-facing software, assume mass exploitation and proactively hunt for web shells and other footholds.
  • Prefer managed services with a hardened, automatic patch cadence for high-value internet-facing systems like email, rather than carrying the patch burden on-premises.

References

Related vulnerabilities

All Infra →