ProxyLogon (CVE-2021-26855 and related)

Background

ProxyLogon is the informal name for a chain of vulnerabilities affecting on-premises deployments of Microsoft Exchange Server 2013, 2016, and 2019. The name, coined by researcher Orange Tsai, reflects that the exploit chain abuses Exchange's front-end proxy architecture together with its logon and authentication mechanisms to achieve remote code execution without valid credentials. The most critical flaw in the chain, CVE-2021-26855, is a server-side request forgery (SSRF) vulnerability that allows an unauthenticated attacker to send arbitrary HTTP requests and authenticate as the Exchange server itself.

Discovery

The vulnerability chain was discovered by Orange Tsai, a researcher at the Taiwanese security firm DEVCORE, during research into Exchange's proxy logic. DEVCORE reports that it identified the initial CVE-2021-26855 issue in December 2020 and had developed a complete pre-authentication remote code execution chain, combining the SSRF bug with a post-authentication arbitrary file-write vulnerability (CVE-2021-27065), by the end of that month. DEVCORE privately reported the chain to Microsoft on January 5, 2021, through Microsoft's responsible disclosure process, rather than releasing it publicly. Separately, the cybersecurity firm Volexity says it detected what it describes as the first known real-world exploitation and breach of an Exchange server using these techniques on January 6, 2021, indicating that at least one threat actor was already exploiting the flaws before Microsoft's advisory.

The vulnerability chain

Microsoft's security advisory, published March 2, 2021, described four distinct zero-day vulnerabilities used together in attacks: CVE-2021-26855, a server-side request forgery bug in Exchange's client access service; CVE-2021-26857, an insecure deserialization flaw in the Unified Messaging service allowing code execution as SYSTEM; and CVE-2021-26858 and CVE-2021-27065, both post-authentication arbitrary file-write vulnerabilities. Chained together, these flaws let an attacker with only network access to an Exchange server's HTTPS port (443) authenticate as an administrator, write a file (typically a web shell) to the server, and execute arbitrary code, all without needing any valid account credentials.

Exploitation by HAFNIUM and mass scanning

Microsoft attributed the initial, targeted exploitation of these vulnerabilities to a group it named HAFNIUM, which it assessed to be a state-sponsored actor operating out of China. According to Microsoft's Threat Intelligence Center, HAFNIUM primarily targeted U.S.-based entities across sectors including infectious disease research, law firms, higher education, defense contractors, policy think tanks, and NGOs, operating from leased virtual private servers located in the United States to obscure its origin. Once Microsoft released patches and published technical details on March 2, 2021, the vulnerabilities were rapidly reverse-engineered, and other threat actors, including additional Chinese-linked groups and financially motivated criminals, began mass-scanning the internet for vulnerable Exchange servers, planting web shells for later access even on systems that were subsequently patched.

Impact and response

The scale of exploitation was described by security researchers as historically large for a single vulnerability chain, with estimates of roughly 250,000 Exchange servers compromised globally, including an estimated 30,000 organizations in the United States, disproportionately affecting small businesses, local governments, and other entities with limited IT security resources. On March 12, 2021, security researchers observed the DearCry ransomware being deployed against unpatched, previously compromised Exchange servers, illustrating how the initial espionage-focused intrusion set was followed by opportunistic criminal exploitation. The U.S. Cybersecurity and Infrastructure Security Agency issued emergency directives requiring federal agencies to patch or disconnect vulnerable servers, and Microsoft released a one-click mitigation tool for organizations unable to immediately apply full patches.

Attribution and legacy

On July 19, 2021, the United States, joined by the United Kingdom, the European Union, and NATO, formally attributed the Exchange Server exploitation campaign to actors affiliated with China's Ministry of State Security, marking one of the first instances of a coordinated multinational public attribution of a major cyber campaign to a state intelligence service. ProxyLogon, alongside the related ProxyShell vulnerability chain disclosed later in 2021, is frequently cited in security industry retrospectives as a turning point that accelerated enterprise migration away from on-premises Exchange servers toward cloud-hosted email and renewed scrutiny of vendor patch-disclosure timelines for widely deployed enterprise software.

Timeline

• 2020-12Orange Tsai of DEVCORE identifies the initial CVE-2021-26855 SSRF flaw in Exchange Server's proxy architecture and, by month's end, develops a complete pre-authentication remote code execution chain.
• 2021-01-05DEVCORE privately reports the vulnerability chain to Microsoft through responsible disclosure.
• 2021-01-06Cybersecurity firm Volexity detects what it describes as the first known real-world breach of an Exchange server using the technique.
• 2021-02-28Attackers, later attributed to HAFNIUM, begin more broadly planting web shells on vulnerable Exchange servers ahead of public disclosure.
• 2021-03-02Microsoft publishes a security advisory and out-of-band patches for CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065, and publicly attributes initial exploitation to the group HAFNIUM.
• 2021-03-05Mass scanning and exploitation by additional threat actors surges, with security researchers reporting thousands of servers compromised per hour; CISA and other agencies issue emergency guidance.
• 2021-03-12Security researchers observe DearCry ransomware being deployed against previously compromised, unpatched Exchange servers.
• 2021-08-06Full technical details of the ProxyLogon exploit chain are publicly disclosed by DEVCORE and Orange Tsai.
• 2021-07-19The United States, United Kingdom, European Union, and NATO formally attribute the Exchange Server exploitation campaign to China's Ministry of State Security.