CVE-2021-34523

What it actually does

CVE-2021-34523 is an elevation-of-privilege weakness in Microsoft Exchange Server associated with the ProxyShell attack chain. It allows an unauthenticated attacker, when combined with the related Exchange pre-authentication and post-authentication flaws commonly exploited alongside it, to bypass normal Exchange authentication and act with elevated Exchange privileges. In practical exploitation, attackers use it to obtain privileged access to Exchange PowerShell or backend Exchange functionality, enabling mailbox access, configuration changes, mailbox export abuse, and, in chained attacks, writing a web shell to the Exchange server for remote command execution.

Why it matters to the business

Successful exploitation can give attackers control over a Microsoft Exchange server, which is often a high-value system containing sensitive email, credentials, address books, and internal communications. Because this vulnerability is in CISA KEV, has extremely high EPSS, has been actively exploited in the wild, and has been associated with ransomware activity including Ghost/Cring ransomware, unpatched internet-facing Exchange servers should be treated as high-risk assets that can lead to data theft, business email compromise, ransomware deployment, and operational disruption. CISA required remediation by 2021-11-17 for covered organizations, so any remaining exposure is significantly overdue.

How an attack unfolds

An attacker typically starts by identifying an internet-facing Microsoft Exchange Server and fingerprinting whether it is an affected on-premises Exchange deployment. In real-world ProxyShell-style exploitation, the attacker sends crafted requests to Exchange Autodiscover and backend service paths to reach internal Exchange functionality through the front-end proxy. The elevation-of-privilege component is then used to obtain or simulate privileged Exchange access, commonly against Exchange PowerShell or mailbox-related operations. Once the attacker has sufficient Exchange privileges, they may create or abuse mailbox export requests, write a web shell into an IIS-accessible Exchange directory, and use that web shell to execute commands. Follow-on activity often includes credential harvesting, mailbox exfiltration, reconnaissance, persistence, lateral movement, and, in ransomware campaigns such as Ghost/Cring, encryption or extortion operations.

How to fix it

Apply the latest supported Microsoft Exchange Server Cumulative Update and Security Update for the installed Exchange version. Organizations should not rely on partial mitigation because this vulnerability is commonly exploited as part of a chain; all Exchange ProxyShell-related fixes must be present. If a server cannot be patched immediately, remove direct internet exposure, restrict access to Exchange administrative endpoints such as PowerShell and ECP, place access behind a VPN or strongly authenticated reverse proxy, and monitor aggressively until patching is complete. After patching, assume that previously exposed vulnerable systems may already be compromised: hunt for web shells, suspicious mailbox export requests, unauthorized Exchange role assignments, unexpected accounts, and attacker-created scheduled tasks or services. If compromise is suspected, rebuild or recover Exchange from trusted media rather than only deleting visible web shells.

How to confirm the fix worked

Confirm the server is running a supported Exchange Server build with the latest Cumulative Update and Security Update installed. Use Microsoft Exchange Health Checker or equivalent build verification to confirm all required security updates are present. Validate that internet-facing endpoints such as /autodiscover/, /ecp/, /owa/, and /powershell/ no longer expose vulnerable behavior and that administrative endpoints are access-controlled. Review IIS logs for historical ProxyShell request patterns before the patch date, and inspect Exchange and IIS web directories for unauthorized ASPX files. Confirm there are no unexpected mailbox export requests, suspicious role assignments, newly created privileged accounts, malicious scheduled tasks, or unusual processes spawned by IIS worker processes.

Typical attack path

1. Scan the internet for exposed Microsoft Exchange Server Outlook Web App, Autodiscover, ECP, or PowerShell endpoints.
2. Fingerprint the Exchange version or patch level using HTTP responses, headers, paths, or known Exchange behavior.
3. Send crafted ProxyShell-style requests to Autodiscover and backend Exchange endpoints to reach privileged Exchange services.
4. Abuse the elevation-of-privilege flaw to obtain unauthorized Exchange privileges, commonly enabling access to Exchange PowerShell or mailbox operations.
5. Use elevated Exchange functionality to create mailbox export requests, modify Exchange settings, or stage files in web-accessible directories.
6. Drop an ASPX web shell or similar payload under an Exchange or IIS web directory.
7. Execute operating system commands through the web shell and establish persistence.
8. Harvest credentials, access mailboxes, exfiltrate sensitive data, move laterally, or deploy ransomware.

How to detect it

Review IIS logs from Exchange front-end and back-end sites, especially W3SVC logs, for ProxyShell-style requests involving Autodiscover, ECP, PowerShell, MAPI, and mailbox export activity. Look for requests containing /autodiscover/autodiscover.json with an @ character, backend targeting of /powershell/, suspicious 200/241/500 response patterns, unusual user agents, and requests followed by creation of ASPX files. Review Exchange Management, PowerShell Operational, MSExchange Management, and Windows Security logs for unexpected New-MailboxExportRequest activity, RBAC changes, mailbox permission changes, new or modified transport rules, and administrative actions from unusual accounts or source IPs. Review file system artifacts under Exchange and IIS web directories for recently created or modified ASPX, ASHX, or config files. In EDR or Windows event logs, look for w3wp.exe spawning command interpreters or scripting tools such as cmd.exe, powershell.exe, rundll32.exe, regsvr32.exe, certutil.exe, bitsadmin.exe, mshta.exe, or living-off-the-land utilities. For ransomware-related follow-on activity, also investigate mass file modification, credential dumping, lateral movement, suspicious scheduled tasks, new services, and security tool tampering after any Exchange exploitation indicators.

• /autodiscover/autodiscover.json?@
• /autodiscover/autodiscover.json
• /powershell/
• /ecp/
• /owa/auth/
• X-Rps-CAT
• New-MailboxExportRequest
• Set-MailboxExportRequest
• Get-MailboxExportRequest
• Remove-MailboxExportRequest
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\auth\
• C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\ecp\auth\
• C:\Program Files\Microsoft\Exchange Server\V15\ClientAccess\ecp\
• C:\inetpub\wwwroot\aspnet_client\
• C:\Program Files\Microsoft\Exchange Server\V15\Logging\HttpProxy\
• C:\inetpub\logs\LogFiles\W3SVC1\
• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> regsvr32.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• POST /powershell/
• POST /ecp/
• POST /autodiscover/autodiscover.json

What your security team should do

• Immediately identify all on-premises Microsoft Exchange servers, especially internet-facing systems, and verify patch status against the latest supported Exchange Cumulative Update and Security Update.
• Treat any unpatched or historically exposed Exchange server as potentially compromised due to active exploitation, KEV listing, ransomware association, and very high EPSS likelihood.
• Run Microsoft Exchange Health Checker and Microsoft Safety Scanner or equivalent EDR/forensic tooling on all Exchange servers.
• Search IIS, Exchange, PowerShell, Windows event, EDR, and proxy logs for ProxyShell-style Autodiscover, ECP, PowerShell, and mailbox export activity.
• Inspect Exchange and IIS web directories for unknown ASPX files, especially under OWA, ECP, aspnet_client, and FrontEnd HttpProxy paths.
• Review Exchange RBAC roles, mailbox export requests, transport rules, inbox rules, delegated mailbox permissions, and newly created accounts for unauthorized changes.
• Restrict Exchange administrative endpoints from the internet and require strong authentication for administrative access.
• If web shells or attacker command execution are found, initiate incident response, isolate the server, preserve forensic evidence, rotate credentials, and consider rebuilding the server from trusted media.