Microsoft Exchange - Authentication Bypass

Exploited in the wild. Listed by CISA on 2022-01-18; known to be used by ransomware.

highseverity

7.3CVSS score

98.2%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Microsoft Exchange Server Information Disclosure Vulnerability. This vulnerability enables an attacker to bypass authentication and gain access to the Exchange Server's internal.

Impact

Unauthenticated attackers can bypass authentication using a SecurityToken cookie, gaining access to Exchange Server's internal API endpoints and sensitive information.

Fix

Apply security updates provided by Microsoft to fix the authentication bypass vulnerability.

How to confirm it

Send: GET /ecp/{{email}}/PersonalSettings/HomePage.aspx?showhelp=false
Positive when: contains "<span id=\"msgCode\">403</span>" and "function signOut() {" AND contains in header "Microsoft.Exchange.Data.Storage.ObjectNotFoundException" and "X-BEResource=" AND status 403

Run it with nuclei: nuclei -id CVE-2021-33766 -u <target>

The full check

id: CVE-2021-33766

info:
  name: Microsoft Exchange - Authentication Bypass
  author: daffainfo
  severity: high
  description: |
    Microsoft Exchange Server Information Disclosure Vulnerability. This vulnerability enables an attacker to bypass authentication and gain access to the Exchange Server's internal.
  impact: |
    Unauthenticated attackers can bypass authentication using a SecurityToken cookie, gaining access to Exchange Server's internal API endpoints and sensitive information.
  remediation: |
    Apply security updates provided by Microsoft to fix the authentication bypass vulnerability.
  reference:
    - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-33766
    - https://www.zerodayinitiative.com/advisories/ZDI-21-798/
    - https://github.com/demossl/CVE-2021-33766-ProxyToken
    - https://nvd.nist.gov/vuln/detail/CVE-2021-33766
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
    cvss-score: 7.3
    cve-id: CVE-2021-33766
    epss-score: 0.98176
    epss-percentile: 0.99914
    cwe-id: NVD-CWE-noinfo
    cpe: cpe:2.3:a:microsoft:exchange_server:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: microsoft
    product: exchange_server
    shodan-query:
      - vuln:cve-2021-26855
      - http.favicon.hash:1768726119
      - http.title:"outlook"
      - cpe:"cpe:2.3:a:microsoft:exchange_server"
    fofa-query:
      - title="outlook"
      - icon_hash=1768726119
    google-query: intitle:"outlook"
  tags: cve,cve2021,microsoft,exchange,auth-bypass,kev,vkev,vuln

variables:
  email: "{{randstr}}@{{rand_base(5)}}.com"

http:
  - raw:
      - |
        GET /ecp/{{email}}/PersonalSettings/HomePage.aspx?showhelp=false HTTP/1.1
        Host: {{Hostname}}
        Cookie: SecurityToken=x

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '<span id="msgCode">403</span>'
          - 'function signOut() {'
        condition: and

      - type: word
        part: header
        words:
          - "Microsoft.Exchange.Data.Storage.ObjectNotFoundException"
          - "X-BEResource="
        condition: and

      - type: status
        status:
          - 403

References

Use this check only on systems you are authorised to test. Where the data comes from