Vulnerability Checks of Exchange Proxy Shell (CVE-2021-34473) | Cybersecurity Blog | Grey Noise
Summary: Security researcher Orange Tsai demonstrated a proof-of-concept exploit at BlackHat 2021 for Microsoft Exchange vulnerabilities including a Pre-auth Path Confusion leading to ACL bypass tracked as CVE-2021-34473, also called ProxyShell. GreyNoise observed no mass scanning until Aug. 9 and saw a significant uptick as of Thursday, Aug. 12, and created two tags: Exchange ProxyShell Vuln Check, covering public variations such as checking access to /mapi/nspi that exposes Version, User, UPN, SID, and Organization, and Exchange ProxyShell Vuln Attempt, covering active attempts that chain the Pre-Auth Path Confusion for Elevation of Privilege via CVE-2021-34523 or Post-auth Arbitrary-File-Write leading to remote code execution via CVE-2021-31207.
What's compelling: The vulnerability check alone can expose Version, User, UPN, SID, and Organization through /mapi/nspi, and GreyNoise tags even that check as malicious intent out of caution - so an unpatched Exchange server can leak directory detail before any exploitation begins.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-31207CVE-2021-34473CVE-2021-34523
- Related