CVE-2021-26855criticalbajo ataqueransomwareCWE-918

CVE-2021-26855: fallo crítico en Microsoft Exchange Server 2013 Cumulative…

Microsoft Exchange Server Remote Code Execution Vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Microsoft Exchange Server

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

100Vexday Risk Score

Corrige ahora. Ella está bajo explotación confirmada por CISA, tiene exploit funcional público y 4 grupo(s) de amenaza la utilizan.

ssvc Actcvss 9.1epss 100%
de la publicación al arma1 día
Publicada en NVD2 mar
1ª PoC+1d
metasploit2 mar
CISA KEV+246d
Quién la explota — 4

Grupos conocidos por explotar esta vulnerabilidad (atribución MITRE ATT&CK).

APT / EstatalAPT41🇨🇳 MITRE ATT&CK
APT / EstatalMagic Hound🇮🇷 MITRE ATT&CK
APT / EstatalThreat Group-3390🇨🇳 MITRE ATT&CK
APT / EstatalToddyCat MITRE ATT&CK
Acción exigida por CISAplazo federal: 2022-05-03

Apply updates per vendor instructions.

En resumen

Una vulnerabilidad crítica en Microsoft Exchange Server permite que atacantes ejecuten código malicioso de forma remota en servidores afectados. Un atacante puede explotar esta falla para obtener control total del sistema de correo electrónico sin necesidad de credenciales válidas.

Detalle técnico

Esta vulnerabilidad de Server-Side Request Forgery (SSRF) en el servicio Autodiscover de Exchange Server permite que atacantes no autenticados ejecuten código arbitrario mediante solicitudes HTTP maliciosas que eludan controles de autenticación. La vulnerabilidad permite ejecución de código remoto con privilegios SYSTEM, afectando todas las versiones de Exchange Server 2013, 2016 y 2019 en configuraciones predeterminadas.

Resumen generado y traducido por IA a partir de la descripción oficial.

El análisis completo de esta CVE está disponible en portugués →

Microsoft Exchange Server Remote Code Execution Vulnerability
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:F/RL:O/RC:C
Productos afectados
Microsoft · Microsoft Exchange Server 2013 Cumulative Update 21Microsoft · Microsoft Exchange Server 2013 Cumulative Update 22Microsoft · Microsoft Exchange Server 2013 Cumulative Update 23Microsoft · Microsoft Exchange Server 2016 Cumulative Update 10Microsoft · Microsoft Exchange Server 2016 Cumulative Update 11Microsoft · Microsoft Exchange Server 2016 Cumulative Update 12Microsoft · Microsoft Exchange Server 2016 Cumulative Update 13Microsoft · Microsoft Exchange Server 2016 Cumulative Update 14Microsoft · Microsoft Exchange Server 2016 Cumulative Update 15Microsoft · Microsoft Exchange Server 2016 Cumulative Update 16Microsoft · Microsoft Exchange Server 2016 Cumulative Update 17Microsoft · Microsoft Exchange Server 2016 Cumulative Update 18Microsoft · Microsoft Exchange Server 2016 Cumulative Update 19Microsoft · Microsoft Exchange Server 2016 Cumulative Update 8Microsoft · Microsoft Exchange Server 2016 Cumulative Update 9Microsoft · Microsoft Exchange Server 2019Microsoft · Microsoft Exchange Server 2019 Cumulative Update 1Microsoft · Microsoft Exchange Server 2019 Cumulative Update 2Microsoft · Microsoft Exchange Server 2019 Cumulative Update 3Microsoft · Microsoft Exchange Server 2019 Cumulative Update 4Microsoft · Microsoft Exchange Server 2019 Cumulative Update 5Microsoft · Microsoft Exchange Server 2019 Cumulative Update 6Microsoft · Microsoft Exchange Server 2019 Cumulative Update 7Microsoft · Microsoft Exchange Server 2019 Cumulative Update 8
PoCs públicas encontradas — 102
exploitdbwww.exploit-db.com/exploits/49637no verificadoexploitdbwww.exploit-db.com/exploits/49663no verificadoexploitdbwww.exploit-db.com/exploits/49879no verificadoexploitdbwww.exploit-db.com/exploits/49895no verificadogithubgithub.com/Flangvik/SharpProxyLogon★ 247githubgithub.com/hosch3n/ProxyVulns★ 176githubgithub.com/dwisiswant0/proxylogscan★ 166githubgithub.com/p0wershe11/ProxyLogon★ 123githubgithub.com/h4x0r-dz/CVE-2021-26855★ 98githubgithub.com/cert-lv/exchange_webshell_detection★ 98githubgithub.com/hackerschoice/CVE-2021-26855★ 59githubgithub.com/alt3kx/CVE-2021-26855_PoC★ 53githubgithub.com/praetorian-inc/proxylogon-exploit★ 52githubgithub.com/conjojo/Microsoft_Exchange_Server_SSRF_CVE-2021-26855★ 36githubgithub.com/RickGeex/ProxyLogon★ 33githubgithub.com/ZephrFish/Exch-CVE-2021-26855★ 28githubgithub.com/evilashz/ExchangeSSRFtoRCEExploit★ 28githubgithub.com/pussycat0x/CVE-2021-26855-SSRF★ 24githubgithub.com/soteria-security/HAFNIUM-IOC★ 22githubgithub.com/hakivvi/proxylogon★ 22githubgithub.com/srvaccount/CVE-2021-26855-PoC★ 17githubgithub.com/r0xDB/CVE-2021-26855★ 12githubgithub.com/mil1200/ProxyLogon-CVE-2021-26855★ 10githubgithub.com/kh4sh3i/ProxyLogon★ 9githubgithub.com/thau0x01/poc_proxylogon★ 8githubgithub.com/Mr-xn/CVE-2021-26855-d★ 6githubgithub.com/La3B0z/CVE-2021-26855-SSRF-Exchange★ 6githubgithub.com/SCS-Labs/HAFNIUM-Microsoft-Exchange-0day★ 5githubgithub.com/sgnls/exchange-0days-202103★ 5githubgithub.com/hackerxj007/CVE-2021-26855★ 5githubgithub.com/TaroballzChen/ProxyLogon-CVE-2021-26855-metasploit★ 4githubgithub.com/ZephrFish/Exch-CVE-2021-26855_Priv★ 4githubgithub.com/Yt1g3r/CVE-2021-26855_SSRF★ 4githubgithub.com/mekhalleh/exchange_proxylogon★ 4githubgithub.com/Immersive-Labs-Sec/ProxyLogon★ 3githubgithub.com/KotSec/CVE-2021-26855-Scanner★ 3githubgithub.com/ssrsec/Microsoft-Exchange-RCE★ 3githubgithub.com/byinarie/Zirconium★ 2githubgithub.com/SimoesCTT/CTT-Exchange-RCE-v1.0---Microsoft-Exchange-Exploit-CVSS-10.0-CRITICAL-CVE-2021-26855-CVE-2021-27065★ 1githubgithub.com/glen-pearson/ProxyLogon-CVE-2021-26855★ 1githubgithub.com/ShyTangerine/cve-2021-26855★ 0githubgithub.com/SimoesCTT/CTT-ProxyLogon-RCE-v1.0---Convergent-Time-Theory-Enhanced-Microsoft-Exchange-Exploit★ 0githubgithub.com/probablysecure/Triage-CVE-2021-26855-ProxyLogon---Microsoft-Exchange-★ 0githubgithub.com/yaoxiaoangry3/Flangvik★ 0githubgithub.com/haotiku/CVE-2021-26855-exploit-Exchange★ 0githubgithub.com/hictf/CVE-2021-26855-CVE-2021-27065★ 0githubgithub.com/sydneysamantha/Triage-CVE-2021-26855-ProxyLogon---Microsoft-Exchange-★ 0githubgithub.com/1342486672/Flangvik★ 0githubgithub.com/DCScoder/Exchange_IOC_Hunter★ 0githubgithub.com/layee27/JIMOH-ABDULLAHI★ 0githubgithub.com/catmandx/CVE-2021-26855-Exchange-RCE★ 0githubgithub.com/mauricelambert/ExchangeWeaknessTest★ 0githubgithub.com/TheDudeD6/ExchangeSmash★ 0githubgithub.com/antichown/Scan-Vuln-CVE-2021-26855★ 0githubgithub.com/Wercd/CVE-2021-26855★ 0githubgithub.com/wysssadda/ExchangeSmash★ 0githubgithub.com/timb-machine-mirrors/testanull-CVE-2021-26855_read_poc.txt★ 0githubgithub.com/ifeoluwaayodeji/CVE-2021-26855-Analysis★ 0githubgithub.com/Nick-Yin12/106362522★ 0vulncheckvulncheck.com/xdb/e2f6662dc7fano verificadovulncheckvulncheck.com/xdb/5c885ac1f498no verificadovulncheckvulncheck.com/xdb/d5ace7521e90no verificadovulncheckvulncheck.com/xdb/b4779b7a6194no verificadovulncheckvulncheck.com/xdb/ee22e208e22eno verificadovulncheckvulncheck.com/xdb/05d9d20036f6no verificadovulncheckvulncheck.com/xdb/b21c4b028688no verificadovulncheckvulncheck.com/xdb/f64e212b9bb9no verificadovulncheckvulncheck.com/xdb/2036c9063358no verificadovulncheckvulncheck.com/xdb/a15ecee3c689no verificadovulncheckvulncheck.com/xdb/2a12da6c6076no verificadovulncheckvulncheck.com/xdb/83c67e8456f8no verificadovulncheckvulncheck.com/xdb/67248d70edfcno verificadovulncheckvulncheck.com/xdb/2786587022bfno verificadovulncheckvulncheck.com/xdb/4781ef8356a6no verificadovulncheckvulncheck.com/xdb/9e7adbbf3d6fno verificadovulncheckvulncheck.com/xdb/e8bde62c54d3no verificadocve_referencepacketstormsecurity.com/files/162736/Microsoft-Exchange-ProxyLogon-Collector.htmlno verificadocve_referencepacketstormsecurity.com/files/162610/Microsoft-Exchange-2019-Unauthenticated-Email-Download.htmlno verificadocve_referencepacketstormsecurity.com/files/161846/Microsoft-Exchange-2019-SSRF-Arbitrary-File-Write.htmlno verificadocve_referencepacketstormsecurity.com/files/161938/Microsoft-Exchange-ProxyLogon-Remote-Code-Execution.htmlno verificadovulncheckvulncheck.com/xdb/58046e2f91e9no verificadovulncheckvulncheck.com/xdb/30ee56a1adacno verificadovulncheckvulncheck.com/xdb/5a8c766c84abno verificadovulncheckvulncheck.com/xdb/c3f6061e329dno verificadovulncheckvulncheck.com/xdb/0c24aac0812fno verificadovulncheckvulncheck.com/xdb/84f6d976cfa8no verificadovulncheckvulncheck.com/xdb/28a1acb64734no verificadovulncheckvulncheck.com/xdb/e988e4b21a5ano verificadovulncheckvulncheck.com/xdb/a369a563695ano verificadovulncheckvulncheck.com/xdb/8f164084f63fno verificadovulncheckvulncheck.com/xdb/a0bdc897dbadno verificadovulncheckvulncheck.com/xdb/f4e64f41f675no verificadovulncheckvulncheck.com/xdb/f1d2fcb25c52no verificadovulncheckvulncheck.com/xdb/d311705d5c0fno verificadovulncheckvulncheck.com/xdb/2e432cbc1287no verificadovulncheckvulncheck.com/xdb/f0b67c3b0dbano verificadovulncheckvulncheck.com/xdb/6285ee0370aeno verificadovulncheckvulncheck.com/xdb/94ed869bb771no verificadovulncheckvulncheck.com/xdb/41560d8dfafano verificadovulncheckvulncheck.com/xdb/aeab84aa7850no verificadovulncheckvulncheck.com/xdb/bfaf5252611bno verificadovulncheckvulncheck.com/xdb/db86afdc28ecno verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Microsoft Exchange Server 2013 Cumulative…

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-34473CRITICALMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2021-34523CRITICALMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 100.0%KEVCVE-2022-41082HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 100.0%KEVCVE-2022-41040HIGHMicrosoft Exchange Server Elevation of Privilege VulnerabilityEPSS 100.0%KEVCVE-2021-27065HIGHMicrosoft Exchange Server Remote Code Execution VulnerabilityEPSS 99.9%KEVCVE-2021-31207MEDIUMMicrosoft Exchange Server Security Feature Bypass VulnerabilityEPSS 99.8%KEV