Microsoft Exchange Proxy Vulnerabilities

Microsoft Exchange Bugs

Aug 18th 2021

Earlier this month (August 2021), a security researcher named Orange Tsai discussed the details of a series of new Microsoft Exchange exploits at the annual BlackHat USA 2021 security conference.

Tsai published a total of eight vulnerabilities, one of which discovered in January 2021 was described as potentially “the most severe vulnerability in the history of Microsoft Exchange”.

In March, the vulnerability was one of four patched by Microsoft that was being actively exploited by an APT known as “Hafnium”. Tsai dubbed the exploit ProxyLogon, because it leveraged exploits in both the Exchange Proxy architecture and the Logon mechanism.

In his remote address to BlackHat USA, Tsai announced that ProxyLogon formed “a whole new attack surface” as he proceeded to detail the vulnerabilities that he had discovered. 

These vulnerabilities cover server-side, client-side and cryptographic bugs, and can be broken down into three powerful exploit chains:

  1. ProxyLogon, the well-known pre-auth Remote Code execution chain exploited in March (CVE-2021-26855, CVE-2021-27065)
  2. ProxyOracle, a plaintext password recovery attacking chain (CVE-2021-31196, CVE-2021-31195)
  3. ProxyShell, a pre-auth RCE that earned Tsai an award (and $200,000) at this year’s Pwn2Own contest (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207)


Tsai responsibly disclosed these bugs to Microsoft, which has issued patches. Two additional bugs disclosed by Tsai (
CVE-2021-33768) were patched by Microsoft in the more recent July 2021 Security Updates.

Whilst Tsai did not release a proof-of-concept (PoC) exploit for ProxyShell vulnerabilities, it appears two other security researchers have developed and published a working exploit based on the information in the BlackHat presentation.

Introduction to Windows 11 (Beta) Security

Introduction to Windows 11 (Beta) Security

HTTP/3 and QUIC: A new era of speed and security

HTTP/3 and QUIC: A new era of speed and security?

Microsoft reports open redirection phishing tactic

Microsoft reports open redirection phishing tactics

Fortinet WAF allows remote code execution

Fortinet WAF allows remote code execution

PetitPotam: Windows AD CS NTLM Relay Attack

PetitPotam: Windows AD CS NTLM Relay Attack

What to do after your penetration testing report

What should you do after your penetration testin...

What is penetration testing and why is it important to use a CREST-approved provider?

What is penetration testing and why is it importa...

How to prepare your business for secure cloud migration

How to prepare your business for secure cloud mig...

How secure use of the cloud can transform your business

How secure use of the cloud can digitally transfo...

What is crest and how does it benefit you?

What is CREST and what are the benefits of using ...

How can the 10 steps to cyber security help to protect your organisation?

How can the 10 steps to cyber security help to pr...

The importance of cyber security

Celebrating Sentrium’s contribution to cyber secu...

What is OWASP Application Security

What is OWASP application security?

Pentration testing report

What should you do after your penetration testing...

Protect against a phishing attack

How to protect against a phishing attack

Secure data in cloud computing

How to secure data in cloud computing

The Security risks of cloud computing

What are the security risks of cloud computing?

Maintain security when employees work remotely

How to maintain security when employees work remo...

Identify and avoid phishing attacks

How to identify and avoid phishing attacks

Penetration testing

What is penetration testing and why is it important?
  • Left Arrow Icon
  • Right Arrow Icon