Code, HTML, php web programming source code. Abstract code background - 3d rendering

New Exchange RCE vulnerability actively exploited

Tim

24th November 2021

Exchange admins now have another exploit to deal with despite still reeling from a number of high profile attacks this year including ProxyLogon and ProxyShell. A new high severity Remote Code Execution (RCE) exploit for on-premise Exchange Servers has been published and is being actively exploited in the wild.

The Exchange vulnerability exploit being tracked as CVE-2021-42321, has a CVSSv3 score of 8.8, placing it firmly into the serious category. Thankfully, the issue was patched by Microsoft in this month’s updates, but earlier this week the Proof of Concept (PoC) exploit code was published by security researcher Janggggg, meaning there will likely be an increase in attacks. Janggggg garnered some attention when he released a PoC for the Exchange ProxyShell exploit in August.

This new deserialization exploit targets Exchange Server 2019 and Exchange Server 2016 including those in Exchange Hybrid mode and requires authentication. Previously, Exchange 2013 was thought to be affected but Microsoft updated its guidance on the 17th of November to state it was not.

Exchange Online customers are already protected and are not required to take any further action. Currently, the only known remediation is to apply the November Security Updates for Exchange which were released by Microsoft on 9th November as part of Patch Tuesday.

Microsoft has published some guidance on how updates might be completed, as it may be necessary to update to one of the supported Cumulative Updates (CUs) before applying the security update to remediate the Exchange vulnerability.

To identify servers that need updating, the Exchange Server Health Checker script can be run against your environment. Microsoft also offers the Exchange Update Wizard to help ensure that all necessary updates are installed.

Some users running in Exchange Hybrid mode had reported an issue after installing the update and receiving a “Something went wrong” error. The temporary workaround is to navigate to https://outlook.office.com/owa directly without URL redirects.

The following PowerShell query was also circulated to identify if your server has been targeted:

Get-EventLog -LogName Application -Source “MSExchange Common” -EntryType Error | Where-Object { $_.Message -like “*BinaryFormatter.Deserialize*” }

 

As Microsoft Exchange remains a popular target for exploitation, the guidance is to immediately apply the latest security patches to protect your environment. Sentrium can actively help you identify vulnerabilities, for more information take a look at our penetration testing services or contact us today.

Resources

  • Insights
  • Labs
White box penetration testing

Uncovering vulnerabilities with white box penetration testing

As a business owner or IT professional, you understand the importance of protecting your company’s sensitive data, systems and reputation from cyber threats. One of…

API penetration testing

Securing APIs through penetration testing

APIs (Application Programming Interfaces) have become the backbone of many modern applications, and indeed the foundation of some businesses services. APIs enable seamless communication between…

The importance of a post-penetration test action plan

The importance of a post-penetration test action plan

As cyber threats continue to evolve and become more sophisticated, businesses must stay one step ahead in protecting their sensitive data and network infrastructure. Penetration…

How to choose the right penetration testing partner

How to choose the right penetration testing partner for your business

In today’s digital landscape, cybersecurity threats are evolving at an alarming rate. With the growing number of cyber-attacks and data breaches, businesses must prioritise their…

IoT device security, penetration testing

Securing the Internet of Things: Penetration testing’s role in IoT device security

The world is witnessing a remarkable transformation as more devices become interconnected, forming what’s known as the Internet of Things (IoT). From smart refrigerators and…

Man working as a junior penetration tester

My first month working as a junior penetration tester

Entering the world of cyber security as a junior penetration tester has been an eye-opening experience for me. In my first month, I’ve encountered challenges,…

Password cracking: How to crack a password

An introduction to password security: How to crack a password

Online Password Cracking An online attack is performed in real-time, against live services or applications to compromise active user accounts. Such attacks typically occur when…

Application Security 101 – HTTP headers

Application Security 101 – HTTP Headers Information Disclosure

Server Header Information Disclosure The most common HTTP header that is enabled by default in most web servers is the ‘Server’ header, which can lead…

SPF, DKIM, DMARC and BIMI for Email Security

SPF, DKIM, DMARC and BIMI for Email Security

Sender Policy Framework Sender Policy Framework (SPF) is a DNS TXT record that is added to a domain that tells email recipients which IP addresses…

Terraform security best practices

Terraform security best practices (2022)

The following sections discuss our most important Terraform security best practices: The importance of Terraform State Terraform must keep track of the resources created. When…

Security vulnerability in Follina exploit

Preventing exploitation of the Follina vulnerability in MSDT

The Follina Exploit A zero-click Remote Code Execution (RCE) vulnerability has started making the rounds which is leveraging functionality within applications such as Microsoft Word.…

Application Security 101 – HTTP headers

Application Security 101 – HTTP headers

1. Strict-Transport-Security The HTTP Strict Transport Security (HSTS) header forces browsers and other agents to interact with web servers over the encrypted HTTPS protocol, which…