New Exchange RCE vulnerability actively exploited

Exchange-Exploit

Nov 24th 2021

 

Exchange admins now have another exploit to deal with despite still reeling from a number of high profile attacks this year including ProxyLogon and ProxyShell. A new high severity Remote Code Execution (RCE) exploit for on-premise Exchange Servers has been published and is being actively exploited in the wild. 

The exploit being tracked as CVE-2021-42321, has a CVSSv3 score of 8.8, placing it firmly into the serious category. Thankfully, the issue was patched by Microsoft in this month’s updates, but earlier this week the proof of concept (PoC) exploit code was published by security researcher Janggggg, meaning there will likely be an increase in attacks. Janggggg garnered some attention when he released a PoCs for the Exchange ProxyShell exploit in August. 

This new deserialization exploit targets Exchange Server 2019 and Exchange Server 2016 including those in Exchange Hybrid mode and requires authentication. Previously, Exchange 2013 was thought to be affected but Microsoft updated its guidance on the 17th of November to state it was not. 

Exchange Online customers are already protected and are not required to take any further action. Currently, the only known remediation is to apply the November Security Updates for Exchange which were released by Microsoft on 9th November as part of Patch Tuesday. 

Microsoft has published some guidance on how updates might be completed, as it may be necessary to update to one of the supported Cumulative Updates (CUs) before applying the security update. 

To identify servers that need updating, the Exchange Server Health Checker script can be run against your environment. Microsoft also offers the Exchange Update Wizard to help ensure that all necessary updates are installed.

Some users running in Exchange Hybrid mode had reported an issue after installing the update and receiving a “Something went wrong” error. The temporary workaround is to navigate to https://outlook.office.com/owa directly without URL redirects. 

The following PowerShell query was also circulated to identify if your server has been targeted: 

Get-EventLog -LogName Application -Source “MSExchange Common” -EntryType Error | Where-Object { $_.Message -like “*BinaryFormatter.Deserialize*” }

As Microsoft Exchange remains a popular target for exploitation, the guidance is to immediately apply the latest security patches to protect your environment.

Path traversal bug in Grafana: Preventable mistake or an important lesson?

Path traversal bug in Grafana: Preventable mistak...

How effective is secure code review for discovering vulnerabilities?

How effective is secure code review for discoveri...

Application Security (AppSec)

Application Security (AppSec)

Dealing with Dependencies

Enhancing Security in your Software Development L...

Exchange Server Emergency Mitigation Service

Exchange Server Emergency Mitigation Service

VMware

VMware vCenter Critical RCE Vulnerability

OWASP

OWASP Top 10 2021 Released

Introduction to Windows 11 (Beta) Security

Introduction to Windows 11 (Beta) Security

HTTP/3 and QUIC: A new era of speed and security

HTTP/3 and QUIC: A new era of speed and security?

Microsoft reports open redirection phishing tactic

Microsoft reports open redirection phishing tactics

Fortinet WAF allows remote code execution

Fortinet WAF allows remote code execution

Microsoft Exchange Bugs

Microsoft Exchange Proxy Vulnerabilities

PetitPotam: Windows AD CS NTLM Relay Attack

PetitPotam: Windows AD CS NTLM Relay Attack

What to do after your penetration testing report

What should you do after your penetration testin...

What is penetration testing and why is it important to use a CREST-approved provider?

What is penetration testing and why is it importa...

How to prepare your business for secure cloud migration

How to prepare your business for secure cloud mig...

How secure use of the cloud can transform your business

How secure use of the cloud can digitally transfo...

What is crest and how does it benefit you?

What is CREST and what are the benefits of using ...

How can the 10 steps to cyber security help to protect your organisation?

How can the 10 steps to cyber security help to pr...

The importance of cyber security

Celebrating Sentrium’s contribution to cyber secu...

What is OWASP Application Security

What is OWASP application security?

Pentration testing report

What should you do after your penetration testing...

Protect against a phishing attack

How to protect against a phishing attack

Secure data in cloud computing

How to secure data in cloud computing

The Security risks of cloud computing

What are the security risks of cloud computing?

Maintain security when employees work remotely

How to maintain security when employees work remo...

Identify and avoid phishing attacks

How to identify and avoid phishing attacks

Penetration testing

What is penetration testing and why is it important?
  • Left Arrow Icon
  • Right Arrow Icon