CVE-2021-34473

What it actually does

CVE-2021-34473 is a pre-authentication server-side request forgery vulnerability in Microsoft Exchange Server. An unauthenticated remote attacker can send crafted requests to Exchange Client Access Service endpoints and cause the server to route requests as though they were intended for internal Exchange backend services. In known ProxyShell-style attack chains, this vulnerability is commonly combined with additional Exchange flaws to gain privileged backend access, write files such as web shells, and ultimately execute arbitrary code in the context of the Exchange server. The vulnerability has a CVSS score of 9.1, requires no authentication or user interaction, is network-exploitable, and has been actively exploited in the wild.

Why it matters to the business

Successful exploitation can give attackers control over an internet-facing email server, enabling mailbox access, credential theft, lateral movement, malware deployment, and ransomware. Because Exchange servers often have privileged access to identity, email, and internal network resources, compromise can rapidly escalate into organization-wide disruption. This vulnerability is listed in CISA KEV, has an extremely high EPSS score, is associated with ransomware activity including Ghost/Cring ransomware, and has been publicly known for years, so any unpatched or exposed Exchange server should be treated as at high risk of compromise.

How an attack unfolds

An attacker first identifies an exposed Microsoft Exchange Server and probes Exchange Autodiscover and PowerShell-related endpoints for ProxyShell behavior. They send crafted unauthenticated requests that abuse the SSRF flaw to reach internal Exchange backend services. In common real-world chains, the attacker combines this access with related Exchange vulnerabilities to obtain an Exchange security context, perform privileged operations, and write attacker-controlled content to a web-accessible directory. The attacker then invokes the dropped web shell or payload over HTTP/S to run commands on the server. Post-exploitation activity may include reconnaissance, mailbox export or access, credential dumping, persistence, deployment of additional tools, lateral movement, and ransomware staging or encryption.

How to fix it

Apply Microsoft security updates for Exchange Server that address the July 2021 ProxyShell vulnerabilities, including CVE-2021-34473, and ensure Exchange is updated to a supported cumulative update level before applying the latest security update. If the server cannot be patched immediately, remove direct internet exposure where possible, restrict access to Exchange administrative and PowerShell endpoints, place Exchange behind a properly configured reverse proxy or VPN, and monitor aggressively for exploitation. Temporary mitigations are not a substitute for patching. Because this vulnerability is in CISA KEV with a remediation deadline of 2021-11-17 and is associated with ransomware, any exposed unpatched system should be prioritized for emergency remediation and compromise assessment.

How to confirm the fix worked

Confirm that all Microsoft Exchange servers are on supported cumulative updates with the relevant July 2021 or later security updates installed. Use Microsoft Exchange Health Checker to validate patch status, configuration risk, and build numbers. From an external perspective, verify that exposed Exchange endpoints no longer exhibit ProxyShell-vulnerable behavior and that administrative endpoints such as PowerShell and ECP are not unnecessarily exposed. Review IIS logs and file system artifacts for historical exploitation before considering remediation complete, because patching does not remove web shells or attacker persistence.

Typical attack path

1. Scan the internet or target ranges for exposed Microsoft Exchange Server Outlook Web App, Autodiscover, or ECP endpoints.
2. Send crafted unauthenticated HTTP/S requests to Exchange frontend endpoints to trigger SSRF routing to backend Exchange services.
3. Chain the SSRF with additional Exchange vulnerabilities commonly associated with ProxyShell to obtain elevated Exchange backend access.
4. Create or abuse Exchange objects and functionality to write attacker-controlled files to a web-accessible path.
5. Execute commands through the deployed web shell or payload.
6. Perform post-exploitation actions such as credential theft, mailbox access, persistence, lateral movement, and ransomware deployment.

How to detect it

Review Exchange IIS logs, HTTP proxy logs, Windows event logs, PowerShell logs, EDR telemetry, and web-accessible Exchange directories for evidence of ProxyShell exploitation. Focus on requests to Autodiscover, MAPI, ECP, and PowerShell endpoints containing unusual email-like path fragments, encoded backend routing values, abnormal 241/200/500 response patterns, or attacker-controlled mailbox identifiers. Search for unexpected ASPX files in Exchange web directories, especially files created around suspicious IIS requests. Investigate command execution from IIS worker processes, including w3wp.exe spawning cmd.exe, powershell.exe, rundll32.exe, certutil.exe, bitsadmin.exe, mshta.exe, or encoded PowerShell. Look for Exchange PowerShell activity creating unusual mailbox export requests, role assignments, virtual directories, or web shell staging. Known exploitation has been used in ransomware campaigns, so also hunt for post-exploitation behaviors such as credential dumping, archive staging, remote service creation, lateral movement, and ransomware binaries executed after Exchange web activity.

• /autodiscover/autodiscover.json
• /autodiscover/autodiscover.json?@
• /mapi/nspi/
• /mapi/emsmdb/
• /powershell/?X-Rps-CAT=
• X-Rps-CAT
• Email=autodiscover/autodiscover.json
• /ecp/
• w3wp.exe spawning cmd.exe
• w3wp.exe spawning powershell.exe
• w3wp.exe spawning rundll32.exe
• w3wp.exe spawning certutil.exe
• w3wp.exe spawning bitsadmin.exe
• w3wp.exe spawning mshta.exe
• C:\\inetpub\\wwwroot\\aspnet_client\\
• C:\\Program Files\\Microsoft\\Exchange Server\\V15\\FrontEnd\\HttpProxy\\owa\\auth\\
• C:\\Program Files\\Microsoft\\Exchange Server\\V15\\FrontEnd\\HttpProxy\\ecp\\auth\\
• C:\\Program Files\\Microsoft\\Exchange Server\\V15\\FrontEnd\\HttpProxy\\aspnet_client\\
• New-MailboxExportRequest
• Set-OabVirtualDirectory
• New-ManagementRoleAssignment
• Remove-MailboxExportRequest
• *-MailboxExportRequest
• powershell.exe -enc
• powershell.exe -EncodedCommand
• cmd.exe /c whoami
• cmd.exe /c ipconfig
• cmd.exe /c net user
• cmd.exe /c net group
• cmd.exe /c nltest

What your security team should do

• Immediately inventory all Microsoft Exchange Server instances, including internet-facing, internal, disaster recovery, and legacy systems.
• Patch or decommission all affected Exchange servers as an emergency priority; this issue is KEV-listed, has near-certain exploitation likelihood, and is associated with ransomware campaigns.
• Run Microsoft Exchange Health Checker and Microsoft Safety Scanner or equivalent EDR-based scans on every Exchange server.
• Conduct a compromise assessment focused on ProxyShell activity, including IIS logs, suspicious ASPX files, abnormal PowerShell activity, mailbox export activity, new privileged accounts, and persistence mechanisms.
• Restrict external access to Exchange administrative endpoints, especially PowerShell and ECP, and enforce least privilege for Exchange administrators.
• Rotate credentials and review tokens/secrets if exploitation is suspected, especially for Exchange administrators and service accounts.
• Hunt for ransomware precursor activity such as credential dumping, remote execution tools, unusual archive creation, data staging, and lateral movement from Exchange servers.
• Preserve forensic images and logs before cleanup where compromise is suspected, because web shell deletion alone may destroy useful evidence without removing all persistence.