News
Vulnerability · Global · March 2021
ProxyLogon in Microsoft Exchange Server (CVE-2021-26855)
A chain of Exchange Server flaws allowed unauthenticated attackers to compromise mail servers hosted on premises worldwide.
Incident
What happened
A server side request forgery flaw (CVE-2021-26855) was chained with other vulnerabilities to achieve code execution.
Attackers installed web shells on exposed Exchange servers to maintain access.
Mass exploitation by multiple threat actors followed the disclosure.
Analysis
Lessons learned
Email servers hosted on premises and exposed to the internet require rapid patching.
Investigation after patching is required to find persistence such as web shells.
Reducing internet exposure of management interfaces lowers risk.
Prevention
How penetration testing helps
External network and web testing identify exposed mail and collaboration services and verify their patch and configuration state.
Sources
Summary based on publicly available information. DIGITPOL was not involved in this incident.