Microsoft Exchange Proxy Vulnerabilities


18th August 2021

2 min read

Earlier this month (August 2021), a security researcher named Orange Tsai discussed the details of a series of new Microsoft Exchange exploits at the annual BlackHat USA 2021 security conference.

Tsai published a total of eight vulnerabilities, one of which discovered in January 2021 was described as potentially “the most severe vulnerability in the history of Microsoft Exchange”.

In March, the vulnerability was one of four patched by Microsoft that was being actively exploited by an APT known as “Hafnium”. Tsai dubbed the exploit ProxyLogon, because it leveraged exploits in both the Exchange Proxy architecture and the Logon mechanism.

In his remote address to BlackHat USA, Tsai announced that ProxyLogon formed “a whole new attack surface” as he proceeded to detail the vulnerabilities that he had discovered.

These vulnerabilities cover server-side, client-side and cryptographic bugs, and can be broken down into three powerful exploit chains:

  1. ProxyLogon, the well-known pre-auth Remote Code execution chain exploited in March (CVE-2021-26855CVE-2021-27065)
  2. ProxyOracle, a plaintext password recovery attacking chain (CVE-2021-31196CVE-2021-31195)
  3. ProxyShell, a pre-auth RCE that earned Tsai an award (and $200,000) at this year’s Pwn2Own contest (CVE-2021-34473CVE-2021-34523CVE-2021-31207)

Tsai responsibly disclosed these bugs to Microsoft, which has issued patches. Two additional bugs disclosed by Tsai (CVE-2021-33768) were patched by Microsoft in the more recent July 2021 Security Updates.

Whilst Tsai did not release a proof-of-concept (PoC) exploit for ProxyShell vulnerabilities, it appears two other security researchers have developed and published a working exploit based on the information in the BlackHat presentation.


  • Insights
  • Labs

OWASP Top 10 2021 Released

The Open Web Application Security Project (OWASP) is a not-for-profit organisation that aims, through community-led open-source projects, to improve the security of web-based software. OWASP…

What is penetration testing and why is it important to use a CREST-approved provider?

Trusting the effectiveness of your IT security controls is crucial to mitigate risks and malicious access to your systems and the information they store. Penetration…

How secure use of the cloud can digitally transform your business

Companies that move towards digital transformation can innovate more quickly, scale efficiently and reduce risk by implementing cloud security best practices. Businesses must keep up…

How to prepare your business for secure cloud migration

The cloud holds a lot of potential for organisations. Moving your IT environment to a secure cloud provides flexibility and agility. It allows your team…

Celebrating Sentrium’s contribution to cyber security

2020 is the year that remote working exploded. Businesses and the general public had to quickly adapt to new ways of working caused by the…

What is CREST and what are the benefits of using a CREST accredited company?

We’re delighted to announce that Sentrium Security is now a CREST accredited company! This is an exciting achievement for us and it’s great to be…

Preventing exploitation of the Follina vulnerability in MSDT

The Follina Exploit A zero-click Remote Code Execution (RCE) vulnerability has started making the rounds which is leveraging functionality within applications such as Microsoft Word.…

Application Security 101 – HTTP headers

1. Strict-Transport-Security The HTTP Strict Transport Security (HSTS) header forces browsers and other agents to interact with web servers over the encrypted HTTPS protocol, which…

New Exchange RCE vulnerability actively exploited

Exchange admins now have another exploit to deal with despite still reeling from a number of high profile attacks this year including ProxyLogon and ProxyShell.…

How effective is secure code review for discovering vulnerabilities?

We’ve recently discussed application security and the trend we’re seeing in which companies are increasingly implementing security early on in the Software Development Life Cycle…

Application Security (AppSec)

There is a movement in the IT security world that is gaining traction, and it is based around the implementation of security within applications from…

Enhancing Security in your Software Development LifeCycle – Dealing with Dependencies

The adoption of agile practices has resulted in the emergence of shift-lift testing, where testing is performed much earlier in the Software Development LifeCycle (SDLC).…