{"data":{"case":{"actions":{"de":["Installiere die aktuellen Sicherheitsupdates für deinen Exchange Server; ein Server ohne die Updates vom März 2021 ist für diese Angriffe offen.","Prüfe den Server auch nach dem Update auf Webshells und andere Spuren eines Angriffs: Die Angriffe begannen im Januar 2021, zwei Monate vor dem Fix.","Wenn du den Server nicht binnen Tagen patchen kannst, zieh einen gehosteten Maildienst in Betracht; Microsofts Exchange Online war nicht betroffen."],"en":["Install the current security updates for your Exchange Server; a server without the March 2021 updates is open to these attacks.","Check the server for web shells and other signs of attack, even after updating: the attacks began in January 2021, two months before the fix.","If you cannot keep the server patched within days, consider a hosted mail service; Microsoft's Exchange Online was not affected."]},"criteria":{"damage":{"de":"Eine Gesamtsumme des Schadens oder der gestohlenen Postfächer ist nicht dokumentiert.","en":"No total of the damage or of the stolen mailboxes is documented.","met":false},"exploitation":{"de":"Angreifer legten Webshells auf mehr als 5.000 Mailservern in über 115 Ländern ab, und das ist nur, was ein einziges Sicherheitsunternehmen sah (ESET, 10. März 2021).","en":"Attackers planted web shells on more than 5,000 email servers in over 115 countries, and that is only what one security company saw (ESET, March 10, 2021).","met":true},"reach":{"de":"Fast 400.000 Exchange-Server waren am Tag vor dem Fix online: gefährdete Systeme, nicht gehackte (RiskIQ-Daten über Microsoft, 12. März 2021).","en":"Nearly 400,000 Exchange servers were online the day before the fix: systems at risk, not hacked ones (RiskIQ data via Microsoft, March 12, 2021).","met":true},"response":{"de":"Die US-Behörde CISA erließ einen Tag nach dem Fix die Notfallanweisung 21-02 für Bundesbehörden (CISA, 3. März 2021).","en":"The US agency CISA issued Emergency Directive 21-02 to federal agencies one day after the fix (CISA, March 3, 2021).","met":true}},"cves":["CVE-2021-26855","CVE-2021-26857","CVE-2021-26858","CVE-2021-27065"],"cvss":9.8,"cvss_version":"3.1","cwe":"CWE-918, CWE-502, CWE-22","dates":[{"date":"2020-12-10","key":"discovered"},{"date":"2021-01-03","key":"exploited"},{"date":"2021-01-05","key":"reported"},{"date":"2021-03-02","key":"patched"},{"date":"2021-03-03","de":"Die CISA erlässt die Notfallanweisung 21-02 für US-Bundesbehörden","en":"CISA issues Emergency Directive 21-02 to US federal agencies"}],"de":{"credit":"DEVCORE; Volexity und Dubex meldeten Teile der Angriffskette, die sie bei Angriffen beobachtet hatten","fixed":"Sicherheitsupdates vom 2. März 2021 für Exchange Server 2013, 2016 und 2019","product":"Microsoft Exchange Server 2013, 2016 und 2019, auf eigenen Servern einer Organisation betrieben","summary":"Vier Lücken in Microsoft Exchange ließen Angreifer ohne Passwort Postfächer lesen und Mailserver übernehmen, zwei Monate bevor es einen Fix gab."},"disclosed":"2021-03-02","en":{"credit":"DEVCORE; Volexity and Dubex reported parts of the attack chain seen in attacks","fixed":"Security updates of March 2, 2021 for Exchange Server 2013, 2016 and 2019","product":"Microsoft Exchange Server 2013, 2016 and 2019, run on an organization's own servers","summary":"Four flaws in Microsoft Exchange let attackers read mailboxes and take over mail servers without a password, two months before a fix existed."},"figures":[{"de":"Exchange-Server waren am Tag vor dem Fix gefährdet (knapp so viele; gehackt wurden nicht alle)","en":"Exchange servers at risk the day before the fix (nearly that many; not all were hacked)","value":"400,000"},{"de":"Tage lang liefen Angriffe, bevor es einen Fix gab","en":"days of attacks before a fix existed","value":"58"},{"de":"Server mit Webshells in über 115 Ländern (mehr als; ESET, 10. März 2021)","en":"servers with web shells in over 115 countries (more than; ESET, March 10, 2021)","value":"5,000"}],"kev":"2021-11-03","key":"proxylogon","name":"ProxyLogon","product":"Microsoft Exchange Server","sources":[{"de":"DEVCORE: ProxyLogon, mit vollständiger Zeitleiste","title":"DEVCORE: ProxyLogon, with the full timeline","url":"https://proxylogon.com/"},{"de":"Microsoft: HAFNIUM greift Exchange-Server an (2. März 2021)","title":"Microsoft: HAFNIUM targeting Exchange servers (March 2, 2021)","url":"https://www.microsoft.com/en-us/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"},{"de":"Microsoft Security Response Center: Sicherheitsupdates für Exchange Server","title":"Microsoft Security Response Center: security updates for Exchange Server","url":"https://www.microsoft.com/en-us/msrc/blog/2021/03/multiple-security-updates-released-for-exchange-server"},{"de":"Microsoft: Schutz für selbst betriebene Exchange-Server (12. März 2021)","title":"Microsoft: protecting on-premises Exchange servers (March 12, 2021)","url":"https://www.microsoft.com/en-us/security/blog/2021/03/12/protecting-on-premises-exchange-servers-against-recent-attacks/"},{"de":"Microsoft: Angriffe über die Exchange-Lücken (25. März 2021)","title":"Microsoft: attacks taking advantage of the Exchange flaws (March 25, 2021)","url":"https://www.microsoft.com/en-us/security/blog/2021/03/25/analyzing-attacks-taking-advantage-of-the-exchange-server-vulnerabilities/"},{"de":"Volexity: aktive Ausnutzung der Exchange-Zero-Days","title":"Volexity: active exploitation of the Exchange zero-days","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"},{"de":"ESET: Exchange-Server unter Beschuss von mehr als zehn Angreifergruppen","title":"ESET: Exchange servers under siege from more than ten attacker groups","url":"https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/"},{"de":"CISA-Notfallanweisung 21-02 (abgeschlossen)","title":"CISA Emergency Directive 21-02 (closed)","url":"https://www.cisa.gov/news-events/directives/ed-21-02-mitigate-microsoft-exchange-premises-product-vulnerabilities-closed"},{"de":"DIVD: Scan und Warnungen an Betreiber verwundbarer Exchange-Server","title":"DIVD: scan and warnings to owners of vulnerable Exchange servers","url":"https://csirt.divd.nl/cases/DIVD-2021-00001/"},{"de":"NVD: CVE-2021-26855, mit der Bewertung von Microsoft","title":"NVD: CVE-2021-26855, with Microsoft's score","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-26855"}],"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","year":2021}},"description":"Four flaws in Microsoft Exchange let attackers read mailboxes and take over mail servers without a password. How it worked, who was hit, what to do now.","language":"en","latest_measurement":"2026-10-23","method":"latency-v3","method_page":"https://crackthe.net/method/","source":"https://crackthe.net/","text":"On March 2, 2021, Microsoft released emergency updates for Exchange Server, the mail server software that many organizations run on their own machines. The updates closed four flaws that attackers had already been using for two months: without a password, they could read mailboxes and take control of the server. Once the flaws were public, many more groups joined in.\nHow it worked Exchange has a front end that receives requests from the internet and passes them on to services behind it. The main flaw, CVE-2021-26855, is a server-side request forgery. An attacker who is not logged in sends a crafted request, and the front end forwards it as if the Exchange server itself had asked. That alone was enough to read mailboxes.\nWith this access, the attacker used a second flaw, CVE-2021-27065 or CVE-2021-26858, to write a file of their choice to the server. That file was a web shell, a small web page that runs whatever commands the attacker sends to it. A third flaw, CVE-2021-26857, let attackers run code as SYSTEM, the highest rights on Windows.\nAttackersends a crafted request, no password needed Exchange front endforwards it as if the server itself asked Mailboxescan be read at once Web shellis written to the server Serverruns the attacker\u0026#39;s commands The attack chain: the first flaw opens the door, the second plants a web shell that gives the attacker control of the server. The Taiwanese security company DEVCORE found the first flaw on December 10, 2020. On January 5, 2021, it reported to Microsoft a chain of two flaws that it named ProxyLogon. But the attacks had already started two days earlier, on January 3, the security company Volexity found. Volexity and the company Dubex reported parts of the attack chain they had seen in attacks. Microsoft attributed the first wave to a group it calls HAFNIUM, which it assesses as state-sponsored and operating out of China. These attackers used all four flaws.\nReach and damage On March 1, 2021, the day before the fix, the security company RiskIQ counted nearly 400,000 Exchange servers reachable from the internet, Microsoft reported. That is the number of servers at risk, not the number of servers that were hacked. By March 9, a bit more than 100,000 were still vulnerable. On March 12, about 82,000 were left to update.\nExchange servers without the fix, March 2021 March 1, the day before the fix400,000 March 9100,000 March 1282,000 RiskIQ counts published by Microsoft, rounded as Microsoft gives them: nearly 400,000, a bit more than 100,000, about 82,000.\nNo source gives a total of the servers that attackers broke into. The security company ESET found web shells on more than 5,000 email servers in over 115 countries by March 10, 2021. These figures come from ESET\u0026rsquo;s own products, so they show only part of the picture. ESET counted more than ten different attacker groups, most of them so-called APT groups, teams that spy on targets over long periods.\nAfter the disclosure, criminals moved in as well. By March 25, Microsoft saw web shells from the gang behind the DoejoCrypt ransomware, malware that encrypts files and demands a ransom, on around 1,500 systems. Not all of them reached the stage where files were encrypted. There is no documented total of the damage or of the mailboxes that were stolen.\nThe fix and the response Microsoft had planned to ship the fix on its regular monthly patch day, March 9. It released the updates a week early instead, outside its usual schedule. They cover Exchange Server 2013, 2016 and 2019. Exchange Server 2010 received an update as an extra precaution. Microsoft\u0026rsquo;s cloud service Exchange Online was not affected.\nThe first three weeks after the fix 1 2 3 4 5 1March 2, 2021Microsoft releases the updates, a week earlier than planned 2March 3, 2021The US agency CISA issues Emergency Directive 21-02 to federal agencies\u0026#43;1 day 3March 7, 2021The Dutch volunteer group DIVD has sent more than 42,000 warnings to owners of vulnerable servers\u0026#43;5 days 4March 10, 2021ESET counts more than 5,000 servers with web shells\u0026#43;8 days 5March 25, 2021More than 92 % of the Exchange servers Microsoft knows of are patched or protected\u0026#43;23 days An emergency directive is an order from CISA that US federal agencies must follow; the first deadline of this one ran out two days after it was issued. In the Netherlands, the volunteers of DIVD scanned the internet for vulnerable servers and warned their owners by email. On November 3, 2021, CISA put all four flaws on the first edition of its list of exploited vulnerabilities.\nTwo scores for the same flaw The US National Vulnerability Database rates the main flaw 9.8 of 10. Microsoft rates it 9.1. The difference lies in one detail: Microsoft assumes that this flaw on its own cannot knock the server offline, so it counts no impact on availability.\nSeverity scores for CVE-2021-26855 Microsoft (CVSS 3.1)9.1 NVD (CVSS 3.1)9.8 Both use version 3.1 of the CVSS scale; they differ only in the impact on availability.\nMicrosoft counted seven Exchange flaws in its update of March 2, 2021. Four of them were used in the attacks, and these four are what most reports call ProxyLogon today, although DEVCORE\u0026rsquo;s name strictly covers only its chain of two.","title":"ProxyLogon: the Exchange flaws that opened mail servers","url":"https://crackthe.net/vulnerabilities/proxylogon/"}