New Exchange RCE vulnerability actively exploited

Tim

24th November 2021

Exchange admins now have another exploit to deal with despite still reeling from a number of high profile attacks this year including ProxyLogon and ProxyShell. A new high severity Remote Code Execution (RCE) exploit for on-premise Exchange Servers has been published and is being actively exploited in the wild.

The exploit being tracked as CVE-2021-42321, has a CVSSv3 score of 8.8, placing it firmly into the serious category. Thankfully, the issue was patched by Microsoft in this month’s updates, but earlier this week the proof of concept (PoC) exploit code was published by security researcher Janggggg, meaning there will likely be an increase in attacks. Janggggg garnered some attention when he released a PoCs for the Exchange ProxyShell exploit in August.

This new deserialization exploit targets Exchange Server 2019 and Exchange Server 2016 including those in Exchange Hybrid mode and requires authentication. Previously, Exchange 2013 was thought to be affected but Microsoft updated its guidance on the 17th of November to state it was not.

Exchange Online customers are already protected and are not required to take any further action. Currently, the only known remediation is to apply the November Security Updates for Exchange which were released by Microsoft on 9th November as part of Patch Tuesday.

Microsoft has published some guidance on how updates might be completed, as it may be necessary to update to one of the supported Cumulative Updates (CUs) before applying the security update.

To identify servers that need updating, the Exchange Server Health Checker script can be run against your environment. Microsoft also offers the Exchange Update Wizard to help ensure that all necessary updates are installed.

Some users running in Exchange Hybrid mode had reported an issue after installing the update and receiving a “Something went wrong” error. The temporary workaround is to navigate to https://outlook.office.com/owa directly without URL redirects.

The following PowerShell query was also circulated to identify if your server has been targeted:

Get-EventLog -LogName Application -Source “MSExchange Common” -EntryType Error | Where-Object { $_.Message -like “*BinaryFormatter.Deserialize*” }

 

As Microsoft Exchange remains a popular target for exploitation, the guidance is to immediately apply the latest security patches to protect your environment.

Resources

  • Insights
  • Labs

OWASP Top 10 2021 Released

The Open Web Application Security Project (OWASP) is a not-for-profit organisation that aims, through community-led open-source projects, to improve the security of web-based software. OWASP develop…

What is penetration testing and why is it important to use a CREST-approved provider?

Trusting the effectiveness of your IT security controls is crucial to mitigate risks and malicious access to your systems and the information they store. Penetration…

How secure use of the cloud can digitally transform your business

Companies that move towards digital transformation can innovate more quickly, scale efficiently and reduce risk to company assets. Businesses must keep up with growing customer…

How to prepare your business for secure cloud migration

The cloud holds a lot of potential for organisations. Moving your IT environment to the cloud provides flexibility and agility. It allows your team to…

Celebrating Sentrium’s contribution to cyber security

2020 is the year that remote working exploded. Businesses and the general public had to quickly adapt to new ways of working caused by the…

What is CREST and what are the benefits of using a CREST accredited company?

We’re delighted to announce that Sentrium Security is now a CREST accredited company! This is an exciting achievement for us and it’s great to be…

Application Security 101 – HTTP headers

1. Strict-Transport-Security The HTTP Strict Transport Security (HSTS) header forces browsers and other agents to interact with web servers over the encrypted HTTPS protocol, which…

How effective is secure code review for discovering vulnerabilities?

We’ve recently discussed application security and the trend we’re seeing in which companies are increasingly implementing security early on in the Software Development Life Cycle…

Application Security (AppSec)

There is a movement in the IT security world that is gaining traction, and it is based around the implementation of security within applications from…

Enhancing Security in your Software Development LifeCycle – Dealing with Dependencies

The adoption of agile practices has resulted in the emergence of shift-lift testing, where testing is performed much earlier in the Software Development LifeCycle (SDLC).…

Exchange Server Emergency Mitigation Service

It has been a tough few months for Microsoft. After the SolarWinds/NOBELLIUM attacks, Microsoft Exchange customers were afflicted with a slew of vulnerabilities. In March…

TOP