CVE-2021-31207

What it actually does

CVE-2021-31207 is a Microsoft Exchange Server security feature bypass that can be used as the final stage of the ProxyShell attack chain. At a technical level, an attacker who obtains sufficient Exchange privileges, often by chaining this flaw with other Exchange vulnerabilities, can bypass intended controls around mailbox export/file handling and write attacker-controlled content to locations that should not be writable. In practical exploitation, this can be abused to place an ASPX web shell in an Exchange-accessible web directory, resulting in remote code execution under the Exchange/IIS application context and potentially broader compromise of the underlying Windows server and Active Directory-connected environment.

Why it matters to the business

Successful exploitation can give an attacker control of an Exchange server, enabling theft of email, credential harvesting, internal reconnaissance, lateral movement, and ransomware deployment. This vulnerability is listed in CISA Known Exploited Vulnerabilities, has been used in ransomware campaigns including Ghost/Cring activity, and has an extremely high EPSS score, indicating strong real-world exploitation likelihood. Because Exchange servers are often internet-facing and highly privileged within enterprise networks, compromise can create severe operational disruption, data exposure, regulatory impact, and costly incident response.

How an attack unfolds

An attacker typically targets an exposed Microsoft Exchange Server and chains CVE-2021-31207 with other Exchange vulnerabilities that provide authentication bypass and privilege escalation. After gaining the ability to interact with Exchange PowerShell or mailbox export functionality, the attacker abuses the security feature bypass to write a crafted file, commonly an ASPX web shell, into a web-accessible Exchange or IIS directory. The attacker then sends HTTP requests to the dropped web shell to execute commands, enumerate the environment, dump credentials, stage additional tooling, create persistence, exfiltrate mailbox data, and in ransomware cases deploy encryptors or facilitate hands-on-keyboard intrusion activity. Public exploitation has been observed in the wild for years, and organizations should treat any unpatched or previously exposed Exchange instance as potentially compromised.

How to fix it

Apply Microsoft Exchange Server security updates that include the May 2021 Exchange fixes for CVE-2021-31207 and, preferably, update to the latest supported Exchange Cumulative Update and Security Update for the deployed Exchange version. Because this flaw is commonly exploited as part of the ProxyShell chain, patch all related Exchange vulnerabilities, not only this CVE. If an Exchange server is unsupported, migrate to a supported version or remove it from service. Restrict external access to Exchange administrative interfaces, especially PowerShell and ECP, to trusted management networks or VPN where possible. Review and minimize mailbox export permissions and high-privilege Exchange roles. If exploitation is suspected, do not rely on patching alone; isolate the server, preserve forensic evidence, remove web shells, rotate credentials, and investigate for lateral movement and persistence.

How to confirm the fix worked

Confirm that Exchange is running a supported Cumulative Update and the relevant May 2021 or later Security Update level by using Exchange Health Checker, Microsoft-provided scripts, and Exchange Management Shell version checks. Verify that externally exposed endpoints are limited to required services and that administrative endpoints are not broadly reachable from the internet. Search the filesystem for unexpected ASPX files in Exchange and IIS web directories and validate file hashes, timestamps, and owners against known-good baselines. Review Exchange admin audit logs for suspicious mailbox export activity and role changes. After patching, perform authenticated vulnerability scanning and targeted Exchange security validation to confirm the server is no longer detected as vulnerable to ProxyShell-related attack paths.

Typical attack path

1. Identify an internet-facing Microsoft Exchange Server and fingerprint version, patch level, and exposed endpoints such as Autodiscover, ECP, MAPI, OWA, and PowerShell.
2. Use related Exchange vulnerabilities or stolen credentials to gain the access level needed to invoke Exchange management functionality.
3. Abuse the CVE-2021-31207 security feature bypass to write attacker-controlled content to an unintended path.
4. Drop an ASPX web shell or similar payload into a web-accessible Exchange/IIS directory.
5. Access the web shell over HTTPS and execute commands on the Exchange server.
6. Run discovery commands, dump credentials, access mailboxes, and move laterally using the Exchange server’s network position and privileges.
7. Deploy persistence, additional malware, data exfiltration tools, or ransomware payloads.

How to detect it

Investigate both direct CVE-2021-31207 behavior and the surrounding ProxyShell-style intrusion chain. Collect IIS logs from Exchange front-end sites, Exchange HttpProxy logs, ECP logs, PowerShell logs, Exchange admin audit logs, Windows Security logs, Sysmon/EDR telemetry, and filesystem metadata from Exchange and IIS directories. Look for requests to Autodiscover, MAPI, ECP, OWA, and PowerShell endpoints containing unusual routing strings, encoded URLs, unexpected email-like values, or requests followed by access to newly created ASPX files. Review Exchange admin audit logs for New-MailboxExportRequest, role assignment changes, mailbox export role abuse, and suspicious use of Exchange Management Shell. Search for ASPX, ashx, or other script files created in Exchange web paths, especially around the time of suspicious HTTP requests. Correlate web shell access with child processes spawned by IIS worker processes, such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe, bitsadmin.exe, rundll32.exe, regsvr32.exe, or encoded PowerShell. For ransomware-related activity, hunt for credential dumping tools, mass file modification, backup deletion, remote service creation, unusual SMB/WinRM/RDP activity, and signs of Ghost/Cring-style intrusion behavior. Absence of a single known IOC does not rule out exploitation; prioritize behavioral evidence such as unexpected file writes under Exchange web directories and command execution from w3wp.exe.

• New-MailboxExportRequest
• Set-MailboxExportRequest
• Remove-MailboxExportRequest
• Mailbox Import Export
• /autodiscover/autodiscover.json
• /autodiscover/autodiscover.json?@
• /PowerShell/
• /powershell/
• /mapi/nspi
• X-Rps-CAT
• X-CommonAccessToken
• C:\inetpub\wwwroot\aspnet_client\
• C:\inetpub\wwwroot\aspnet_client\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\*.aspx
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\aspnet_client\
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\aspnet_client\*.aspx
• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning cscript.exe
• w3wp.exe spawning wscript.exe
• w3wp.exe spawning certutil.exe
• w3wp.exe spawning bitsadmin.exe
• cmd.exe /c whoami
• powershell -enc
• powershell -EncodedCommand
• DownloadString(
• Invoke-WebRequest
• IEX(
• aspnet_client/*.aspx
• owa/auth/*.aspx
• ecp/*.aspx

What your security team should do

• Treat this as urgent even if the CVSS score appears moderate: it is in CISA KEV, has ransomware usage, and has a very high exploitation probability.
• Patch all Microsoft Exchange servers to the latest supported Cumulative Update and Security Update, covering the broader ProxyShell chain.
• Prioritize internet-facing Exchange servers first, then internal Exchange servers, hybrid servers, and decommissioned-but-still-reachable systems.
• Run Microsoft Exchange Health Checker and Microsoft Safety Scanner or equivalent EDR-based sweeps for known Exchange web shells and post-exploitation artifacts.
• Hunt for suspicious ASPX files, unusual mailbox export requests, Exchange PowerShell activity, and anomalous IIS requests to Autodiscover, ECP, MAPI, OWA, and PowerShell endpoints.
• Restrict access to Exchange PowerShell and ECP from the internet and enforce administrative access through hardened management paths.
• Rotate credentials for Exchange administrators, service accounts, and any accounts observed interacting with suspicious Exchange activity.
• Investigate for lateral movement, credential dumping, persistence, and ransomware staging if the server was exposed before patching or shows suspicious artifacts.
• Preserve IIS, Exchange, Windows event, PowerShell, EDR, and proxy logs before remediation actions that may overwrite evidence.
• Review CISA KEV guidance and confirm remediation against the 2021-11-17 KEV due date baseline for historical compliance and current risk closure.