ProxyLogon: the Exchange flaws that opened mail servers

On March 2, 2021, Microsoft released emergency updates for Exchange Server, the mail server software that many organizations run on their own machines. The updates closed four flaws that attackers had already been using for two months: without a password, they could read mailboxes and take control of the server. Once the flaws were public, many more groups joined in.

How it worked

Exchange has a front end that receives requests from the internet and passes them on to services behind it. The main flaw, CVE-2021-26855, is a server-side request forgery. An attacker who is not logged in sends a crafted request, and the front end forwards it as if the Exchange server itself had asked. That alone was enough to read mailboxes.

With this access, the attacker used a second flaw, CVE-2021-27065 or CVE-2021-26858, to write a file of their choice to the server. That file was a web shell, a small web page that runs whatever commands the attacker sends to it. A third flaw, CVE-2021-26857, let attackers run code as SYSTEM, the highest rights on Windows.

The Taiwanese security company DEVCORE found the first flaw on December 10, 2020. On January 5, 2021, it reported to Microsoft a chain of two flaws that it named ProxyLogon. But the attacks had already started two days earlier, on January 3, the security company Volexity found. Volexity and the company Dubex reported parts of the attack chain they had seen in attacks. Microsoft attributed the first wave to a group it calls HAFNIUM, which it assesses as state-sponsored and operating out of China. These attackers used all four flaws.

Reach and damage

On March 1, 2021, the day before the fix, the security company RiskIQ counted nearly 400,000 Exchange servers reachable from the internet, Microsoft reported. That is the number of servers at risk, not the number of servers that were hacked. By March 9, a bit more than 100,000 were still vulnerable. On March 12, about 82,000 were left to update.

No source gives a total of the servers that attackers broke into. The security company ESET found web shells on more than 5,000 email servers in over 115 countries by March 10, 2021. These figures come from ESET’s own products, so they show only part of the picture. ESET counted more than ten different attacker groups, most of them so-called APT groups, teams that spy on targets over long periods.

After the disclosure, criminals moved in as well. By March 25, Microsoft saw web shells from the gang behind the DoejoCrypt ransomware, malware that encrypts files and demands a ransom, on around 1,500 systems. Not all of them reached the stage where files were encrypted. There is no documented total of the damage or of the mailboxes that were stolen.

The fix and the response

Microsoft had planned to ship the fix on its regular monthly patch day, March 9. It released the updates a week early instead, outside its usual schedule. They cover Exchange Server 2013, 2016 and 2019. Exchange Server 2010 received an update as an extra precaution. Microsoft’s cloud service Exchange Online was not affected.

An emergency directive is an order from CISA that US federal agencies must follow; the first deadline of this one ran out two days after it was issued. In the Netherlands, the volunteers of DIVD scanned the internet for vulnerable servers and warned their owners by email. On November 3, 2021, CISA put all four flaws on the first edition of its list of exploited vulnerabilities.

Two scores for the same flaw

The US National Vulnerability Database rates the main flaw 9.8 of 10. Microsoft rates it 9.1. The difference lies in one detail: Microsoft assumes that this flaw on its own cannot knock the server offline, so it counts no impact on availability.

Microsoft counted seven Exchange flaws in its update of March 2, 2021. Four of them were used in the attacks, and these four are what most reports call ProxyLogon today, although DEVCORE’s name strictly covers only its chain of two.