Full title: Microsoft Exchange Server Unpublished Pre-Authentication Remote Code Execution Exploit 
Category: remote exploits
Platform: windows
[Description]
First, IT'S NOT PROXYLOGON. IT'S NOT PROXYLOGON. IT'S NOT PROXYLOGON. 
It's an unpublished vulnerability found by myself. It's not exploited in the wild and there's no exploit code on the Internet.

[About The Vulnerability]
It's a exploit chain utilizing pre-auth SSRF + post-auth EoP + post-auth file write to achieve pre-auth RCE on Exchange Server. The corresponding CVE numbers are:
- CVE-2021-28480, CVSS score 10
- CVE-2021-28481, CVSS score 10
- CVE-2021-28482, CVSS score 9

This exploit chain is not memory corruption bug so it's stable, easy to use, and no privilege required, the only limit is you must provide one victim's email as argument.

[Affect Versions]
- Exchange Server 2019 < 15.02.0858.010
- Exchange Server 2019 < 15.02.0792.013
- Exchange Server 2016 < 15.01.2242.008
- Exchange Server 2016 < 15.01.2176.012
- Exchange Server 2013 < 15.00.1497.015

Video: https://0day.today/videos/36585.mp4

# 0day.today @ http://0day.today/