Microsoft Exchange Proxy Vulnerabilities

Microsoft Exchange Proxy Vulnerabilities


18th August 2021

2 min read

Earlier this month (August 2021), a security researcher named Orange Tsai discussed the details of a series of new Microsoft Exchange exploits at the annual BlackHat USA 2021 security conference.

Tsai published a total of eight vulnerabilities, one of which discovered in January 2021 was described as potentially “the most severe vulnerability in the history of Microsoft Exchange”.

In March, the vulnerability was one of four patched by Microsoft that was being actively exploited by an APT known as “Hafnium”. Tsai dubbed the exploit ProxyLogon, because it leveraged exploits in both the Exchange Proxy architecture and the Logon mechanism.

In his remote address to BlackHat USA, Tsai announced that ProxyLogon formed “a whole new attack surface” as he proceeded to detail the vulnerabilities that he had discovered.

These vulnerabilities cover server-side, client-side and cryptographic bugs, and can be broken down into three powerful exploit chains:

  1. ProxyLogon, the well-known pre-auth Remote Code execution chain exploited in March (CVE-2021-26855CVE-2021-27065)
  2. ProxyOracle, a plaintext password recovery attacking chain (CVE-2021-31196CVE-2021-31195)
  3. ProxyShell, a pre-auth RCE that earned Tsai an award (and $200,000) at this year’s Pwn2Own contest (CVE-2021-34473CVE-2021-34523CVE-2021-31207)

Tsai responsibly disclosed these bugs to Microsoft, which has issued patches. Two additional bugs disclosed by Tsai (CVE-2021-33768) were patched by Microsoft in the more recent July 2021 Security Updates.

Whilst Tsai did not release a proof-of-concept (PoC) exploit for ProxyShell vulnerabilities, it appears two other security researchers have developed and published a working exploit based on the information in the BlackHat presentation.

Sentrium can assist with your security needs, view our penetration testing services for more details or contact us today.


  • Insights
  • Labs
White box penetration testing

Uncovering vulnerabilities with white box penetration testing

As a business owner or IT professional, you understand the importance of protecting your company’s sensitive data, systems and reputation from cyber threats. One of…

API penetration testing

Securing APIs through penetration testing

APIs (Application Programming Interfaces) have become the backbone of many modern applications, and indeed the foundation of some businesses services. APIs enable seamless communication between…

The importance of a post-penetration test action plan

The importance of a post-penetration test action plan

As cyber threats continue to evolve and become more sophisticated, businesses must stay one step ahead in protecting their sensitive data and network infrastructure. Penetration…

How to choose the right penetration testing partner

How to choose the right penetration testing partner for your business

In today’s digital landscape, cybersecurity threats are evolving at an alarming rate. With the growing number of cyber-attacks and data breaches, businesses must prioritise their…

IoT device security, penetration testing

Securing the Internet of Things: Penetration testing’s role in IoT device security

The world is witnessing a remarkable transformation as more devices become interconnected, forming what’s known as the Internet of Things (IoT). From smart refrigerators and…

Man working as a junior penetration tester

My first month working as a junior penetration tester

Entering the world of cyber security as a junior penetration tester has been an eye-opening experience for me. In my first month, I’ve encountered challenges,…

Password cracking: How to crack a password

An introduction to password security: How to crack a password

Online Password Cracking An online attack is performed in real-time, against live services or applications to compromise active user accounts. Such attacks typically occur when…

Application Security 101 – HTTP headers

Application Security 101 – HTTP Headers Information Disclosure

Server Header Information Disclosure The most common HTTP header that is enabled by default in most web servers is the ‘Server’ header, which can lead…

SPF, DKIM, DMARC and BIMI for Email Security

SPF, DKIM, DMARC and BIMI for Email Security

Sender Policy Framework Sender Policy Framework (SPF) is a DNS TXT record that is added to a domain that tells email recipients which IP addresses…

Terraform security best practices

Terraform security best practices (2022)

The following sections discuss our most important Terraform security best practices: The importance of Terraform State Terraform must keep track of the resources created. When…

Security vulnerability in Follina exploit

Preventing exploitation of the Follina vulnerability in MSDT

The Follina Exploit A zero-click Remote Code Execution (RCE) vulnerability has started making the rounds which is leveraging functionality within applications such as Microsoft Word.…

Application Security 101 – HTTP headers

Application Security 101 – HTTP headers

1. Strict-Transport-Security The HTTP Strict Transport Security (HSTS) header forces browsers and other agents to interact with web servers over the encrypted HTTPS protocol, which…