Back to CVEs & Disclosures
CRITICAL — CVSS 9.8

Microsoft Exchange Server SSRF Authentication Bypass (ProxyLogon)

Pre-authentication server-side request forgery (SSRF) vulnerability in Microsoft Exchange Server allowing attackers to authenticate as the Exchange server.

Status
Vendor Patched
Reported / Disclosed
2021

Impact

  • Bypass of perimeter authentication via manipulated X-BEResource cookies.
  • Chained with post-auth deserialization to write web shells and dump all mailbox databases.
  • State-sponsored widespread exploitation across worldwide enterprise Exchange infrastructure.

Timeline

  1. JANUARY 2021

    Discovered and reported by DEVCORE security research team.

  2. MARCH 2, 2021

    Microsoft released out-of-band emergency security updates.

aura~
Back to CVEs & Disclosures