CVE-2021-26855

Overview

CVE-2021-26855, the first link in the "ProxyLogon" exploit chain, is a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Server that allows an unauthenticated attacker to bypass authentication entirely by sending crafted HTTP requests that the Exchange back-end processes as if they originate from the Exchange server itself. Combined with CVE-2021-27065 (post-auth arbitrary file write), the chain delivers unauthenticated remote code execution on any internet-facing Exchange server running a vulnerable version.

The vulnerability was discovered by Orange Tsai (Tsai Chi-Yu) of Devcore and reported to Microsoft on January 5, 2021. Unbeknownst to Microsoft, Chinese state-sponsored group HAFNIUM and at least six other threat actor groups had independently discovered and were actively exploiting it as a zero-day before the patch was released. By the time Microsoft issued the emergency patch on March 2, 2021, tens of thousands of Exchange servers had already been compromised.

What Is Microsoft Exchange Server?

Microsoft Exchange Server is the dominant enterprise email and calendaring platform, deployed on-premises by governments, corporations, banks, hospitals, and law firms worldwide. Internet-facing Exchange servers expose several HTTPS endpoints for external email clients (OWA, EAS, ECP, Autodiscover) — making them permanently internet-accessible and high-value targets. Compromise of an Exchange server typically yields access to all email, calendars, and contacts for every user in the organization.

Affected Versions

Exchange 2010 received a separate Defense-in-Depth update. Only on-premises Exchange deployments were vulnerable.

Technical Details

Root Cause: SSRF in Exchange Backend Proxy

Exchange Server's architecture separates a front-end proxy (Client Access Services) from multiple back-end services. The front-end proxy is responsible for routing and authentication. CVE-2021-26855 is an SSRF in the front-end's request handling for the Exchange Control Panel (ECP) and Autodiscover endpoints.

An attacker sends a crafted HTTP request with a specific cookie (X-AnonResource-Backend) that instructs the Exchange front-end proxy to forward the request to an attacker-specified back-end URL. When the proxy forwards the request to the Exchange back-end (on localhost), the back-end server receives it as a trusted internal request — bypassing all front-end authentication checks.

The attacker effectively impersonates any Exchange user, including administrators, by crafting requests that the back-end processes with the spoofed identity.

The ProxyLogon Chain: SSRF + File Write = RCE

CVE-2021-26855 alone gives authentication bypass and authenticated access to any Exchange mailbox. To achieve RCE, it is chained with:

• CVE-2021-27065 — A post-authentication arbitrary file write vulnerability in Exchange's ECP component. An authenticated request (enabled by the SSRF bypass) can write arbitrary files to any path on the Exchange server. Attackers write ASPX webshells to the Exchange web root.

Full exploit chain:

1. Use CVE-2021-26855 SSRF to authenticate as any Exchange user (typically NT AUTHORITY\SYSTEM or an admin account).
2. Use the authenticated session to call the ECP endpoint vulnerable to CVE-2021-27065.
3. Write an ASPX webshell (e.g., China Chopper) to a web-accessible directory on the Exchange server.
4. Access the webshell via HTTPS to execute OS commands as SYSTEM.

Attack Characteristics

Discovery

Orange Tsai (Tsai Chi-Yu) of Devcore discovered the ProxyLogon vulnerability chain as part of a research project studying Exchange's proxy architecture. He reported it to Microsoft on January 5, 2021, 58 days before the patch. During that window, HAFNIUM and at least six other threat actor groups were independently exploiting the same vulnerability as a zero-day — suggesting the vulnerability was known to multiple sophisticated actors before Devcore's research. Microsoft later confirmed that exploitation had begun no later than January 6, 2021.

Exploitation Context

The ProxyLogon disclosure triggered one of the largest coordinated emergency patching efforts for on-premises infrastructure in history:

• Zero-day exploitation by 7+ threat groups before the patch, including HAFNIUM (attributed to China), Tick, LuckyMouse, Calypso, Winnti Group, Tonto Team, and Mikroceen
• HAFNIUM's targets: U.S. law firms, defense contractors, infectious disease researchers, policy think tanks, and NGOs
• Scale of compromise: Microsoft estimated hundreds of thousands of Exchange servers were vulnerable; CISA reported tens of thousands of US organizations compromised by the time the patch was released
• Webshell persistence: Even organizations that patched quickly had often already been backdoored via ASPX webshells that persisted after patching
• Ransomware use: DearCry ransomware was observed deployed via ProxyLogon webshells within days of patch release; multiple subsequent ransomware groups used ProxyLogon for initial access
• CISA ED 21-02: Issued March 3, 2021, requiring federal agencies to patch within 48 hours or disconnect Exchange servers — one of CISA's most urgent-ever directives

Remediation

Recommended Actions

1. Apply the March 2021 Exchange Security Update immediately. All supported Exchange 2013/2016/2019 Cumulative Update levels received patches.

2. Hunt for webshells — the patch does not remove backdoors already installed. Search the Exchange web root for unexpected ASPX files:

   C:\inetpub\wwwroot\aspnet_client\
   C:\Program Files\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\
   

   Microsoft's one-click mitigation tool and the Exchange On-Premises Mitigation Tool (EOMT) can assist.

3. Review IIS logs for exploitation indicators — look for POST requests to /ecp/ with unusual parameters or from unexpected source IPs in the period before patching.

4. Rotate credentials — Exchange SYSTEM access means all credentials cached or processed by Exchange (service accounts, admin passwords in email) should be considered compromised.

5. Migrate to Exchange Online — on-premises Exchange requires ongoing patching of a complex, internet-facing attack surface. Microsoft 365 / Exchange Online removes this exposure entirely.